Interpreting Event 153 Errors

Hello my name is Bob Golding and I would like to share with you a new event that you may see in the system event log.  Event ID 153 is an error associated with the storage subsystem. This event was new in Windows 8 and Windows Server 2012 and was added to Windows 7 and Windows Server 2008 R2 starting with hot fix KB2819485.


An event 153 is similar to an event 129.  An event 129 is logged when the storport driver times out a request to the disk; I described event 129 messages in a previous article.  The difference between a 153 and a 129 is that a 129 is logged when storport times out a request, a 153 is logged when the storport miniport driver times out a request.  The miniport driver may also be referred to as an adapter driver or HBA driver, this driver is typically written the hardware vendor.


Because the miniport driver has a better knowledge of the request execution environment, some miniport drivers time the request themselves instead of letting storport handle request timing.  This is because the miniport driver can abort the individual request and return an error rather than storport resetting the drive after a timeout.  Resetting the drive is disruptive to the I/O subsystem and may not be necessary if only one request has timed out.  The error returned from the miniport driver is bubbled up to the class driver who can log an event 153 and retry the request.


Below is an example event 153:


Event 153 Example


This error means that a request failed and was retried by the class driver.  In the past no message would be logged in this situation because storport did not timeout the request.  The lack of messages resulted in confusion when troubleshooting disk errors because timeouts would occur but there would be no evidence of the error.


The details section of the event the log record will present what error caused the retry and whether the request was a read or write. Below is the details output:


Event 153 Details


In the example above at byte offset 29 is the SCSI status, at offset 30 is the SRB status that caused the retry, and at offset 31 is the SCSI command that is being retried.  In this case the SCSI status was 00 (SCSISTAT_GOOD), the SRB status was 09 (SRB_STATUS_TIMEOUT), and the command was 28 (SCSIOP_READ). 


The most common SCSI commands are:




The most common SRB statuses are below:





A complete list of SCSI operations and statuses can be found in scsi.h in the WDK.  A list of SRB statuses can be found in srb.h.


The timeout errors (SRB_STATUS_TIMEOUT and SRB_STATUS_COMMAND_TIMEOUT) indicate a request timed out in the adapter. In other words a request was sent to the drive and there was no response within the timeout period.  The bus reset error (SRB_STATUS_BUS_RESET) indicates that the device was reset and that the request is being retried due to the reset since all outstanding requests are aborted when a drive receives a reset.


A system administrator who encounters event 153 errors should investigate the health of the computer’s disk subsystem.  Although an occasional timeout may be part of the normal operation of a system, the frequent need to retry requests indicates a performance issue with the storage that should be corrected.

Comments (22)

  1. Mauricio says:

    I dont have WDK to have access to the full scsi.h and srb.h. Could you please post more codes online to make it easier to find more information about this error? I'm getting a 00 04 28, so SCSI is good but SRB is ????, all that while doing a read.

    [Hi Mauricio.  The WDK is a free download, you can get it from  Regarding the error you are seeing, 04 is SRB_STATUS_ERROR.]

  2. Gary says:

    Downloading the whole WDK just to find the codes does seem a little overkill.

    I'd be especially thankful if you could decode the following "02 08 28".

    [Thank you for your feedback.  To decode your message:



    28 – SCSIOP_READ

    It appears your system attempted to read from a device which was not present.  Most likely the device was removed.]

  3. Flavio Muratore says:

    Hey Bob,

    this is great stuff man. Would this also report with wiht the Microsoft iSCSIPORT driver. Can is help troubleshoot dropped frames for an ethernet/iSCSI SAN?

    [Most iSCSI implementations now use msiscsi rather than iscsiport.  To answer your question, it depends on if msiscsi returns an error that that will bubble up to the class driver to be retried.  I do not recall of any errors that are handled in that way. The only one I can think of that may bubble up is SRB_STATUS_BUS_RESET (0xE).  Most all of the retryable errors occur between msiscsi and storport. Msiscsi does not time requests, so you should not see a timeout.]

  4. Mark Doering says:

    We are seeing a ton of these errors on one of our newly deployed Server 2012 boxes.  The error string is "The IO operation at logical block address 22f66d73 for Disk 0 was retried." and the bytes mentioned in the article above are: 02 04 28

    From what I've been able to dig up this means:


    “When the target returns a Check Condition in response to a command it is indicating that it has entered a contingent allegiance condition. This means that an error occurred when it attempted to execute a SCSI command. The initiator usually then issues a SCSI Request Sense command in order to obtain a Key Code Qualifier (KCQ) from the target.”

    30 = 0x04 SRB_STATUS_ERROR

    “Occurs if the HBA returns a nonspecific bus error”

    31 = 0x28 SCSIOP_READ

    “Occurs during a disk read operation”

    So it looks like the OS is having trouble performing a read operation on that block is that correct?  It's always the same logical block address.  Does this indicate a bad drive?  I'm not sure where to go from here.  Thank you for this article, it's the first bit of information I've found helpful at all in troubleshooting this issue.

    [This is most likely a bad drive.]

  5. Wei says:

    Hi, following up on Mauricio's question, can you please tell me where and how to look/check next when getting SRB_STATUS_ERROR = 04? Can you list the all possible causes? Thanks.

    [If the requests to the disk are failing, most likely there is an issue with the controller, cable, disk, etc.]

  6. says:

    Hi, nice information ! After some driver update, my Surface Pro 2 256 insert into event log a lot of this event.

    Chkdsk and scan runs without errors.

    In your opinion do I need to worry about ?


    Log Name:      System

    Source:        disk

    Date:          07/04/2014 20:29:21

    Event ID:      153

    Level:         Warning

    Keywords:      Classic


    The IO operation at logical block address c28 for Disk 0 (PDO name: Device0000034) was retried.

    Event Xml:

    <Event xmlns="" rel="nofollow" target="_new">…/event">


       <Provider Name="disk" />

       <EventID Qualifiers="32772">153</EventID>




       <TimeCreated SystemTime="2014-04-07T23:29:21.458055100Z" />




       <Security />










    [Using the Binary part of that log, the error decodes as:





    Unfortunately there is no indication of what the error was, just that an error occurred.  This may or may not necessarily indicate a hardware failure.]

  7. Stephan says:

    FYI: We use Altaro Hyper-V Backup to backup our Hyper-V machines. Now the Hyper-V Host (where the Backupsoftware runs) logs this event every time after the backup completes; with the code 02 08 28, so the status is:



    28 – SCSIOP_READ

    The disks with the numbers in the logged event are really removed (in my case Disk 1 and Disk 2). When i go to the storage manager, I've got only Disk 0.

    So Altaro mounts the VHD's of the virtual machines to do the backup and unmounts it, when the backup is completed. So the logged event is correct and can be ignored in this case (when you backup your virtual machines with Altaro or any other software acting the same way to backup Hyper-V machines…

    I was really surprised and feared that the disks are going to fail soon 🙂

    Have a nice day everybody

    [You may also be getting event 157 messages if the disks are being surprise removed.  For more information see]

  8. dave says:

    i also assume this could be related to a DVD?


  9. Cherryl says:

    Can you please help me decode this error message:

    0000: 0F 01 04 00 04 00 2C 00   ……,.

    0008: 00 00 00 00 99 00 04 80   ….™..€

    0010: 00 00 00 00 00 00 00 00   ……..

    0018: 00 00 00 00 00 00 00 00   ……..

    0020: 00 00 00 00 00 00 00 00   ……..

    0028: 00 22 04 2A               .".*




    Usually this happens because a frame is dropped.  This is an error at the hardware level (controller, disk, cabling, SAN fabric, etc).]

  10. Mark-Allen Perry says:

    Is there anyway of determining exactly *which* disk was having this error?  Many thanks.

    [The text of the error indicates which disk had the error.  The example shown in this article occurred on Disk 0.  You can correlate the "Disk #" string to a specific disk using Disk Management.]

  11. Zack says:

    I have the following.  0028: 00 00 04 28 ?

    [04 is SRB_STATUS_ERROR.]

  12. Paul says:

    Great article Bob. Thanks for the heads up Stephan, I'm getting 02 08 28 for 3 missing discs on my Hyper-V host logged every hour which relates to the DPM backup of my 3 VMs.

    [Hi Paul.  Unfortunately we are not able to provide 1:1 support through this blog.  The issue reported does not seem to match a known issue.  You can obtain 1:1 support through]

  13. xuxia says:

    hi,Can you please help me decode this error message:



    0000: 0004010F 002C0003 00000000 80040099

    0008: 00000000 00000000 00000000 00000000

    0010: 00000000 00000000 2A0A0000  


    0000: 0F 01 04 00 03 00 2C 00   ……,.

    0008: 00 00 00 00 99 00 04 80   ….™..€

    0010: 00 00 00 00 00 00 00 00   ……..

    0018: 00 00 00 00 00 00 00 00   ……..

    0020: 00 00 00 00 00 00 00 00   ……..

    0028: 00 00 0A 2A               …*



  14. xuxia says:

    hello,I'd be especially thankful if you could decode the following "00 0A 2A"

    [0A is SRB_STATUS_SELECTION_TIMEOUT.  Usually this means the device has been removed from the system.]

  15. Seshadri says:


    I am getting Event ID 153 Warning in one of my server installed with Windows 2012 Standard  and I am finding it difficult to Decode it.

    Can you please help me in Decoding it, Below is the event log

    Binary data:

    In Words

    0000: 0016010F 003E0003 00000000 80040099

    0008: 00000000 00000000 00000000 00000000

    0010: 00000000 00000000 28040200 00050070

    0018: 0A000000 00000000 00000021 0000

    In Bytes

    0000: 0F 01 16 00 03 00 3E 00   ……>.

    0008: 00 00 00 00 99 00 04 80   ….™..€

    0010: 00 00 00 00 00 00 00 00   ……..

    0018: 00 00 00 00 00 00 00 00   ……..

    0020: 00 00 00 00 00 00 00 00   ……..

    0028: 00 02 04 28 70 00 05 00   …(p…

    0030: 00 00 00 0A 00 00 00 00   ……..

    0038: 21 00 00 00 00 00         !…..


    [This does not resemble the binary data from an event 153.  Usually there are only 28 bytes of data.]

  16. Larry0015 says:

    I just got my first warning EVENT id 153 on my new HP desktop (pre-intalled Windows 8.1 64 bit) as follows:

    "The IO operation at logical block address 0x68f4248 for Disk 1 (PDO name: Device0000054) was retried."

    The Binary data as follows:

    In Words

    0000: 0004010F 002C0004 00000000 00000000

    0010: 00000000 00000000 00000000 00000000

    0020: 00000000 00000000 28120000  

    In Bytes

    0000: 0F 01 04 00 04 00 2C 00   ……,.

    0008: 00 00 00 00 00 00 00 00   ….?..?

    0010: 00 00 00 00 00 00 00 00   ……..

    0018: 00 00 00 00 00 00 00 00   ……..

    0020: 00 00 00 00 00 00 00 00   ……..

    0028: 00 00 12 28               …(

    Could someone please help me interpret this? The disk 1 in question is, I think, my one-month old 1TB Toshiba external hard disk which is attached to my desktop for long periods. I seldom detach it.

    Should I be worried about this warning and claim for replacement?

    Thank you.

    [12 is SRB_STATUS_DATA_OVERRUN, 28 is SCSIOP_READ.  An overrun usually means the device had more data than it could fit in the buffer, retrying this request is not necessarily indicative of a hardware failure.]

  17. ThomasRH says:

    I have a server with an iSCSI drive from a NAS. I am getting the Even ID 153 aswell with the message "The IO operation at logical block address 0x40028 for Disk 2 (PDO name: Device000007e) was retried." Looking in the details I am getting this "0028: 00 02 04 8A"




    A check condition during a write usually indicates a problem with the disk hardware.]

  18. Kristoffer says:

    Been able to decode 00 04 88? Been able to decode 00 and 04. Can't find 88 anywhere. Help would be appreciated. Getting flooded with this message. It's one of two identical discs in a twoway storage space mirror, been able to decode this from the PDO. It's only the one disk, nothing reported from the other one.

    [88 is SCSIOP_READ16, it is a larger read operation.  For the purposes of this error it is the same as a 28 SCSIOP_READ operation.]

  19. Beliqar says:


    we have this error almost every day , sometimes with effect on production. please can you check this ?

    timeout during writing? what is it * on the end? can be some problem on hardware or configuration? we have new storage and from this time is every day.

    0028: 00 00 09 2A               …*

    thank you

    [00 is SCSISTAT_GOOD, 09 is SRB_STATUS_TIMEOUT, and 2A is SCSIOP_WRITE.  Your disk timed out a write request.  This indicates a problem with the storage hardware.  The * character is the ASCII representation of the 0x2A character, the output you copied shows hexadecimal on the left and ASCII characters on the right.  Sometimes the ASCII characters are present on purpose (such as when the error logs a string) and sometimes they are simply a coincidence.]

  20. Uninstall Anti-Virus says:

    In my case it was Kaspersky which triggers this error.

    [Perhaps the antivirus was issuing requests to the storage which failed, however antivirus does not usually plug in at the storport miniport layer.]

  21. Christian says:

    I'm getting flooded with event 153 warnings on my computer and i don't know what's causing it.

    Looking in the details i get: "0028: 00 00 04 2A" at every warning.

    I'm running windows 8.1 and I'm using a Samsung 850 EVO SSD.

    I get the warning like every 10 seconds at different block addresses. It doesn't seem to effect my computer, but i guess it is something i should be worried about?

    [04 is SRB_STATUS_ERROR.  I would not ignore storage timeouts, this is a sign of unhealthy storage hardware.]

  22. FLauffer says:

    Nice post! Thanks!