William Stanek: He’s dead, Jim, so why continue to flog him?


William here. Okay, here’s the postmortem aka post-action review (which by the way isn’t such a bad thing to have after a project or extended troubleshooting action is completed). By now you know a disk quota problem can cause some serious issues and those serious issues can look an awful lot like many other problems. Because of this, the approach to troubleshooting this particular problem can help you learn more about troubleshooting disk space problems, permission problems causing disk write failures, etc., etc.

Let the reflecting commence… What to do after resolving the problem? Well, I set up a test environment and then mangled it by applying the same limitations that caused my friends so much trouble. Want to see a few interesting errors I found? Here goes…


Windows Update

Source: CAPI2
Event ID: 4107
Description: Failed extract of third-party root list from auto update cab with error: There is not enough space on the disk.

ASP.NET
Source: ASP.NET
Event ID: 1309
Description: Exception message: The current identity (NT AUTHORITY\SYSTEM) does not have write access to ‘C:\Windows\Microsoft.NET\…

Hyper-V

Source: Hyper-V-VMMS
Event ID: 19510
Description: The Integration Services Setup Disk image could not be updated: There is not enough space on the disk.

Group Policy

Source: GroupPolicy
Event ID: 1089
Description: Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or user.
Source: GroupPolicy
Event ID: 1085
Description: Group Policy failed to apply the … settings. … settings might have its own log file.

Quota

Source: Quota
Event ID: 6
Description: The quota minifilter driver failed to attach to volume “\Device\HarddiskVolume5 (C:)” because of an unexpected error. While the minifilter is detached quota enforcement and management will be unavailable on the volume.

Source: FilterManager
Event ID: 4
Description: Filter System Filter ‘Quota’ failed to attach to volume “\Device\HarddiskVolume5”. The filter returned a non-standard final status.

Task Scheduler

Source: TaskScheduler
Event ID: 701
Description: Task Scheduler service failed to start Task Compatibility module. Tasks may not be able to register on previous Windows versions.

Event Log

Source: Eventlog
Event ID: 22
Description: The event logging service encountered an error while initializing publishing resources for channel Microsoft-Windows-FailoverClustering/Diagnostic. If channel type is Analytic or Debug, then this could mean there was an error initializing logging resources as well.

SUS

Source: ESENT
Event ID: 488
Description: SUS20ClientDataStore. An attempt to create the file … failed with system error … “There is not enough space on the disk.” The create file operation will fail with error …

DNS Server

Source: DNS-Server-Service
Event ID: 3152
Description: The DNS server was unable to open file … for write. Most likely the file is a zone file that is already open. Close the zone file and re-initiate zone write.

DFSR

Source: DFSR
Event ID: 2004
Description: The DFS Replication service stopped replication on volume … This failure occurred because the disk is full, the disk is failing, or a quota limit has been reached. This can also occur if the DFS Replication service encountered errors while attempting to stage files for a replicated folder on this volume.

Source: ESENT
Event ID: 488
Description: DFSRs. An attempt to create the file … failed with system error … “There is not enough space on the disk.” The create file operation will fail with error …


And there you have it, lots of indicators that there are problems. And even better, the way these services behaved can help you diagnose and resolve issues that occur because:

A) A disk is full

B) A disk is failing

C) A quota limit has been reached

As you might imagine, there were a lot more errors, but these were some of my favorites. These are, of course, things to look for in your own troubleshooting.

Thanks for reading! Next up in “Beam me up, Scottie—We’re off to editing states” I’ll talk about configuring special preferences using editing states.

William R. Stanek

williamstanek at aol dot com

Twitter at https://twitter.com/williamstanek

Comments (4)

  1. Steve Syfuhs says:

    Surely there is an event that gets logged stating that disk quota has been reached?

  2. Sean Kearney says:

    Ummm one question.  Where is the log entry that tracks a failed system boot due to "Sparky" the family dog chomping down on the mouse cable shorting out the PC?

    For real.  I’ve had it :)

  3. devonm says:

    Steve and Sean, see William’s post today for responses to your questions. :-)

  4. Patrick says:

    I don't know if this post is too old or what, but I am having issues with my computer lately, and this error came up which flagged this article in google search. The error is "The event logging service encountered an error while initializing publishing resources for channel Security. If channel type is Analytic or Debug, then this could mean there was an error initializing logging resources as well" The main problem I am having, or rather sysmptom I get is, my monitor just goes dark, but not like it's off, it still has a signal. The sides of the screen show some light, you can see it. But the only way to get out of this state is to cold boot the computer. I'm using Windows 7, 64bit, enterprise version (legal copy, not pirated.)I use a crucial SSD 128GB, 6 gigs of RAN, I run benchmark tests and it will not crash, this thing just happens randomly. I thought maybe the error message I pasted above, may have something to do with this problem, don't know. Can anyone offer some help with this issue please? I am getting desperate on figuring this issue out. Thank you.