Random huge amounts of --Event Viewer-- entries that cycle on and off, without a clear pattern, or confirmed reason.

These huge amount of Event-Viewer entries are mostly 'warnings' pointing to disk, Dcom, DeviceSetupManager and others. Sprinkled with a few errors. The major concern is --the Event-Viewer\warnings with the Source: disk; this is causing severe data-loss. While researching the 'disk' warnings, they keep pointing to usb connected hdd's and/or their connection. Not only is the laptop, hdd docking stations and the hdd's newly purchased items, all of them have been swapped-out; and these Event-Viewer disk warnings continue at random dates and times, without any sort of pattern.

There is nothing wrong with the external usb-connected hardware, that the logs are pointing to.

These random huge amount of Event-Viewer entries will also happen with Dcom and others, stated above, and for whatever reason 'SFC /scannow' never finds anything. Just before drafting this post, I restored the box in question back to a 20231204 manual Restore-point; absolutely no installed apps were affected. The immediate results were the repeated string of Event-Viewer\Dcom entries stopped, along with other huge amounts of random Event-Viewer\warnings.

Additionally, this box is running a portable version of 'Notepad++, with it being pinned to the taskbar. After the successful Restore-Point, starting Notepad++ from the pinned taskbar icon does not work; Win-11 offers to remove the icon/shortcut. On the other hand, Left-clicking and existing txt associated with Notepad++ as the default app, will both open with the portable Notepad++, once opened, the pinned Notepad++ will toggle the open instance of Notepad++. After the current instance of Notepad++ is closed, the taskbar\pinned Notepad++ icon\shortcut, will refuse to function and right-clicking will not offer a 'properties' menu item --allowing any editing.

This truly smells like Windows-11

To be clear I'm asking for feedback as to why:
--does Win-11\Event-Viewer thinks there are disk issues
--is Win-11Event-Viewer randomly generating huge amounts of entries Pre_Restore-Point, but after a successful restore, the Event-Viewer stops and/or severely slows down generating those same huge amounts of data?
--given the above, is SFC /scannow not finding anything?

Finally, how to resolve the odd behavior with the Notepad++ icon/shortcut pinned to the taskbar? Yeah, I get "make another shortcut", but why did it break? How to stop it from breaking again?

Respectfully

@Query01
As far as the entries in Event Viewer are concerned, if they don't point to specific errors or issues, then you can mostly ignore them. Just clear the logs and continue.

If you are experiencing actual issues/errors then by all means check the Event Viewer and look for relevant entries.

Since most of the EV entries you mentioned, point to USB drive/s, then you should open a CMD window and run chkdsk DriveLetter: /F on those USB drive/s to make sure there are no issues with the drives.

Also, try using different USB ports when connecting the drives, if possible and make sure all of your USB drivers are up to date.

Are you using the PortableApps.com version of Notepad++?
Where is Notepad++ located?
How did you add the taskbar icon for Notepad++ (please be precise)?

trumpy81 said:

@Query01
Since most of the EV entries you mentioned, point to USB drive/s, then you should open a CMD window and run chkdsk DriveLetter: /F on those USB drive/s to make sure there are no issues with the drives.

Also, try using different USB ports when connecting the drives, if possible and make sure all of your USB drivers are up to date.

Click to expand...

@trumpy81
The above has already been done, as well as, S.M.A.R.T. included with OEM drive specific software: Seatools, WD Dashboard. Nothing is defective in these drives.

trumpy81 said:

Are you using the PortableApps.com version of Notepad++?

Click to expand...

No

trumpy81 said:

How did you add the taskbar icon for Notepad++ (please be precise)?

Click to expand...

From the Notepad++ extracted folder, right-click notepad++.exe, pin to taskbar.

@Query01
Where did you extract the folder, was it to an internal drive or a USB drive?

trumpy81 said:

@Query01
Where did you extract the folder, was it to an internal drive or a USB drive?

Click to expand...

@trumpy81​

usb-A\docking station\3.5" WD_RED(NAS)

There's your issue.

Whenever a USB drive is disconnected/reconnected it can be assigned a different GUID etc. This essentially means that the shortcut no longer points to a valid location, which is why Windows offers to remove the dead shortcut.

Move the Notepad++ folder to an internal drive and then add the taskbar shortcut etc...

Fingers crossed, that should solve your issue.

By all means keep a backup copy on the USB drive, just in case.

trumpy81 said:

There's your issue.

Whenever a USB drive is disconnected/reconnected it can be assigned a different GUID etc. This essentially means that the shortcut no longer points to a valid location, which is why Windows offers to remove the dead shortcut.

Move the Notepad++ folder to an internal drive and then add the taskbar shortcut etc...

Fingers crossed, that should solve your issue.

By all means keep a backup copy on the USB drive, just in case.

Click to expand...

@trumpy81 , Thank you. If a new GUID was issued, why is the taskbar pin able to toggle the UI after the app is running?

Query01 said:

Thank you. If a new GUID was issued, why is the taskbar pin able to toggle the UI after the app is running?

Click to expand...

I'm not sure I'm understanding your point?

Query01 said:

@trumpy81 , Thank you. If a new GUID was issued, why is the taskbar pin able to toggle the UI after the app is running?

Click to expand...

@trumpy81
I understand about a new GUID if/when a usb device dis/reconnects. In that instance the pinned item is pointing to a stale location. That being the case, pinned item not working, I can go to the exe open the application, once opened, the pinned item will in-fact toggle the notepad++ UI.

That is where/how I'm confused.

@Query01
Sorry, I was hung up on your 'toggle the UI' ... lol
That is because the program is loaded into memory and the shortcut no longer needs to access the drive location etc... in order to access the program, it is already running.

@trumpy81 , thank you. Given the app is portable, I would not figured this out on my own; in this decade.

I'm sure you would have eventually, but yeah, it is a little counter-intuitive.

Good luck with it and if you have any other questions, fire away

@trumpy81
Actually trying to figure out why Win-11 is cycling the random disk warnings associated with data loss is paramount. Currently, as seen in the original post, after the restore, the stream of entries mostly stopped; others slowed way down. The restore had no affect on/with any installed application.

Given all drivers, and BIOS are up-to-date, all hardware is new and has been swapped-out for another new replacement, it appears to be the OS. Stand-by for more data, I'm typing now ...

@trumpy81
The box in question writes surveillance footage 24/7. The application authors have not released an update since 2019; I think they're on an extended fishing trip. Every time we do a fresh install of this OS, regardless if its from the OEM img, or the flashdrive created by Microsoft, once installed and completely Windows Updated. the system is not stable; app-hangs and crashes regularly.

This current install is the most stable this box has ever been, by using the 'Reset PC'\keep personal files. I refuse to allow Windows Update to ruin this stability --until I have my back-up machine returned from the OEM. Until that time comes, I'm desperately researching why this random surge of Event-Viewer\warning keep cycling on and off. More recently, what affect the successful System-Restore had to stop and/or slow the surge and why SFC /scannow is not finding anything.

I'm sure the surge will circle back and resume, but there's not pattern.

OK kewl, right click on the Start menu and select Event Viewer.

Then go to Windows Logs > System and on the far right, click on Save All Events As... and then save the file as XXX.evtx, don't include any display info.

I am assuming that is where the drive related messages appear, if not, go to the appropriate log and then save it.

Not sure if the forum will accept .evtx files, if not, right click on the file and select Send to > Compressed (zipped) folder then attach the .zip file to your post.

I will scan through the log and see if anything stands out.

trumpy81 said:

OK kewl, right click on the Start menu and select Event Viewer.

Then go to Windows Logs > System and on the far right, click on Save All Events As... and then save the file as XXX.evtx, don't include any display info.

I will scan through the log and see if anything stands out.

Click to expand...

@trumpy81
Administrative Events, the priority concerns are System logs, source: disk, ntfs and UASPStor. I use the following cmd to find which events are specifying 'lost' or 'unsaved' data, which are mostly source: disk.

GET-eventlog -logname system -message *lost* | ft timegenerated, eventid, message -autosize -wrap

That said, the other warnings are very close by and will usually be within that same surge grouped by date\time.

There are instances when this surge of events cycles, an app will hang, then that hang will also affect Win-11 file explorer causing it to hang. Once this hanging starts to snowball, any app that is hung cannot be terminated by any means, to included alt+F4, the UI, Task Manager\End Task, Task Manager\ End Process Tree nor Taskkill /PID.

Not until or unless I reboot the box -or- disconnect the usb device. Again\reminder, everything is new and has been swapped-out for a new same make\model. This issue of the hanging apps snowballing does not happen every time; but often enough to knock the system offline from writing.

Respectfully

@Query01
Thanks for that.

You did not tell me you had setup RAID at all?

If you are using USB drives in the RAID array then there is the source of your instability. Remember what I said about disconnecting/reconnecting USB drives?

Disk 2 has the same disk identifiers as one or more disks connected to the system. Go to Microsoft's support website (Microsoft Support) and search for KB2983588 to resolve the issue.

Click to expand...

The above is from your EV log and is easily explained by disconnecting/reconnecting USB drives.

My recommendation would be to copy as much data as you can to internal drives or other external USB drives, then delete the RAID configuration. Reformat the USB drives and connect them as individual drives, do NOT add them to a RAID configuration.

Once you have done that, most of your instability should be gone. You may have a program or two that will act up, but they should be relatively easy to wrangle.

If you want to use RAID etc... then invest in a proper NAS. I recommend Synology or QNAP only. There are others and you are free to use them, but I would not recommend them.

The events displayed possible drive problems.




Please test all drives:


1) Sea Tools Long Generic test:




2) HD Tune: (free or trial)

a) Health
b) Benchmark
c) Full error scan



3) HD Sentinel: (trial)

a) Overview
b) Temperature
c) SMART



Make sure that test images / share links are posted into this thread.

zbook said:

The events displayed possible drive problems.




Please test all drives:

Click to expand...

@zbook , with respect, have you read this entire thread before posting? Specifically posts #1 thru #3 <--click it.
With regards to Raid, there is no Raid. All external drives are connected in the following manner; the-box\usb-A\docking-station with dedicated pwr-supply\3.5" hdd.

...continued Respect ...

@Query01
I saw many of these entries in your EV log:

Reset to device, \Device\RaidPort3, was issued.

Click to expand...

I assumed this referred to a RAID array that you had setup. My apologies if that is not the case.

That message does seem to indicate that RAID is in use though, possibly by the Docking Station?

Do you have any settings/controls for that in the Docking Station?