JSI Tip 5568. What is Event ID 51 in the Windows XP System event log?

MORE INFORMATION

An event ID 51 entry is a generic error entry for any type of error that occurs when Windows is paging information to input/output (I/O). A paging operation occurs when Windows either swaps a page of memory from memory to disk, or when Windows retrieves a page of memory from disk to memory. This is part of the memory management features of Windows XP.

Not every disk access is paging I/O. Programs can perform non-buffered I/O to access disk data. Also, Windows is not necessarily writing to the paging file (Pagefile.sys), which the name implies. This may be any type of data access. Event ID 51 is similar to event ID 9 or 11, but it is not as serious an error. Event ID 51 occurs only during a paging I/O operation. If this error occurs when no paging operation is occurring, an event is not logged, which is unlike event ID 9 or 11.

You can troubleshoot event ID 51 in the same manner as event ID 9 or 11. For additional information, click the article number below to view the article in the Microsoft Knowledge Base: You can use the binary data that is associated with any "Disk" error (event IDs 9, 11, 51, and others) to help you identify the problem. You do this by decoding the data section of the error. For additional information about how to decode the data section, click the article number below to view the article in the Microsoft Knowledge Base:

Entries in the Data Section

Because event ID 51 has an additional Cdb field, you must consider the following information when you are reviewing the data section of an event ID 51 entry.

The Error Code

In the sample entry in the "Summary" section of this article, the error code is listed in the second line, which starts with "0008:" and includes the last four octets in the line.

ErrorCode = 0x80040033.

This is the code for error 51, which is the same for all event ID 51 errors:
When you are interpreting the status code from the hexadecimal data in the event ID entry, remember that the values are represented in the little Endian format.

The Final Status Code

In the example in the "Summary" section of this article, the final status code is listed in the third line, which starts with "0010:" and includes the last four octets in the line.

FinalStatus = 0x00000000.

This event ID data indicates "success," so it is probable that no loss of data occurred.

The SCSI Request Block (SRB) Parameters

You can use this data to you help determine where the problem occurred. The Data section is represented in the following format: In the example in the "Summary" section of this article, the ScsiStatus value is 0x02 (the first octet in the "0038" line), and the SrbStatus value is 0x84 (the second octet in the "0038" line). This provides the following information: Ten SCSI errors are currently defined in the Microsoft Windows NT Device Driver Kit (DDK) documentation, and in the Srb.h file. The SCSI miniport calls ScsiPortLogError and supplies a SCSI error value (SP_ xxx) as the ErrorCode parameter. By using the information from the following table, the ScsiPort driver translates the SCSI error to a Windows NT error code (IO_ERR_ xxx).

SRB status codes (from the Srb.h file): This value is used by the port driver to indicate that a non-SCSI-related error occurred. Miniports must never return this status: SRB status values 0x38 through 0x3f are reserved for internal port driver use.

SRB status masks must be broken down; they are a sub-status. They are combined with the error that is listed earlier in this article: For example, 0x84 is 0x80, which equals SRB_STATUS_AUTOSENSE_VALID and 0x04 SRB_STATUS_ERROR.

SCSI status codes (from the Scsi.h file):