Cissesrv Event ID 24606 pm ProLiant ML350 G6

[cherisc]

Any thoughts for me? We are getting a replacement server, but wondering if there is a fix for this or if our data is at high risk for data loss.

Not sure if the xml was changed below in this post, because the forum mistaked it for invalid html.

On a server, we are seeing the following error in the event log:

Log Name: System
Source: Cissesrv
Date: 12/29/2015 11:43:02 PM
Event ID: 24606
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: 
Description:
Logical drive 1 of array controller P410i [Embedded] returned a fatal error during a read/write request from/to the volume.

Logical block address 263040, block count 8 and command 32 were taken from the failed logical I/O request.

Array controller P410i [Embedded] is also reporting that the last physical drive to report a fatal error condition (associated with this logical request), is located in bay 1 of box 1 connected to port 1I.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Cissesrv" />
<EventID Qualifiers="50229">24606</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-12-30T05:43:02.000000000Z" />
<EventRecordID>285781</EventRecordID>
<Channel>System</Channel>
<Computer></Computer>
<Security />
</System>
<EventData>
<Data>Cissesrv</Data>
<Data>P410i [Embedded]</Data>
<Data>1</Data>
<Data>263040</Data>
<Data>8</Data>
<Data>32</Data>
<Data>1</Data>
<Data>1</Data>
<Data>1I</Data>
</EventData>
</Event>

The server is an ProLiant ML350 G6 using the P410i embedded controller with a 512 MB array Accelerator. There are 6 drives in the array, plus a spare in the 7th slot. It's RAID 5.

I have updated all firmware on the recently replaced hard drives and original hard drives, as well as the firmware on the controller. 

I ran HP Array Config diagnostics, Smart Storage Administrator diagnostics, and Insight Manager online, and they all report healthy. 

Attached is the Array Config Diagnostics. 

Other events that may be related below, my comments are in red. 

Log Name: System
Source: Disk
Date: 12/29/2015 11:43:00 PM
Event ID: 7
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: 
Description:
The device, \Device\Harddisk0\DR0, has a bad block.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Disk" />
<EventID Qualifiers="49156">7</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-12-30T05:43:00.385677800Z" />
<EventRecordID>285779</EventRecordID>
<Channel>System</Channel>
<Computer></Computer>
<Security />
</System>
<EventData>
<Data>\Device\Harddisk0\DR0</Data>
<Binary>030080000100000000000000070004C0000100009C0000C000000000000000000000070800000000F243D10200000000FFFFFFFF00000000580000840200040038200A2842072000001000003C00000000B0211280FAFFFFD0B24A0E80FAFFFF000000000000000030D8D31180FAFFFF0000000000000000800304000000000028000004038000000800000000000000700003000000000A00000000110000000000000000000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 12/29/2015 9:23:21 PM
Event ID: 3
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: 
Description:
Filter Manager failed to attach to volume '\Device\Harddisk2\DR25'. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2015-12-30T03:23:21.128411700Z" />
<EventRecordID>285765</EventRecordID>
<Correlation />
<Execution ProcessID="8980" ThreadID="13568" /> Process ID 8980 is currently equal to VDS.exe in task manager
<Channel>System</Channel>
<Computer></Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0xc03a001c</Data>
<Data Name="ExtraStringLength">22</Data>
<Data Name="ExtraString">\Device\Harddisk2\DR25</Data>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-Kernel-General
Date: 12/29/2015 8:29:59 PM
Event ID: 5
Task Category: None
Level: Error
Keywords:
User: DAHLBERG\administrator
Computer: 
Description:
{Registry Hive Recovered} Registry hive (file): '\??\C:\Windows\TEMP\BEV155A.tmp' was corrupted and it has been recovered. Some data might have been lost.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
<EventID>5</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2015-12-30T02:29:59.423284700Z" />
<EventRecordID>285744</EventRecordID>
<Correlation />
<Execution ProcessID="1104" ThreadID="4188" /> PID 1104 is equal to BEREMOTE.exe, the server is running Backup Exec 2012 for backups, and it backs up to external hard drives that are swapped daily. The backup has worked all week.
<Channel>System</Channel>
<Computer></Computer>
<Security UserID="S-1-5-21-1359813550-3578794935-3483755087-500" />
</System>
<EventData>
<Data Name="FinalStatus">0x8000002a</Data>
<Data Name="ExtraStringLength">31</Data>
<Data Name="ExtraString">\??\C:\Windows\TEMP\BEV155A.tmp</Data>
</EventData>
</Event>

Log Name: System
Source: Ntfs
Date: 12/29/2015 8:29:47 PM
Event ID: 55
Task Category: (2)
Level: Error
Keywords: Classic
User: N/A
Computer: 
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \\?\Volume{15991b20-3b9c-11e5-a68f-1cc1de72ca3a}.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ntfs" />
<EventID Qualifiers="49156">55</EventID>
<Level>2</Level>
<Task>2</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-12-30T02:29:47.354594400Z" />
<EventRecordID>285743</EventRecordID>
<Channel>System</Channel>
<Computer></Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>\\?\Volume{15991b20-3b9c-11e5-a68f-1cc1de72ca3a}</Data>
<Binary>0D000C000200380002000000370004C000000000320000C00000000000000000000000000000000082091200FFFFFFFFFFFFFFFF</Binary>
</EventData>
</Event>