⚑ Deus Ex Machina ➽ Eventlog Lookup

Deus Ex Machina » Eventlog » Event 333 - Application Popup

Application Popup - 333


Description »
An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.
Data formatted as » WORDS
0000: 00000000 006c0001 00000000 c000014d
0010: 00000000 c000014d 00000000 00000000
0020: 00000000 00000000

This event is logged when the system tries to read or write the registry from/to disk. This could be related to memory or storage issues.

If you install KB970054, you can set the registry key RegistryFlushErrorSubside to a value of 2, which will cause the machine to bluescreen when the event is encountered. This will give you a memory dump (assuming you've configured crash dumps), which you can analyse with WinDBG to see which memory resources are being used. Use the !vm command for this. Alternatively - you can configure performance counters to monitor paged and non-paged pool usage - and for a deeper level of detail, you can use poolmon.exe.

A good place to start with this issue is the MS Performance Team's blog page on the subject Troubleshooting Event ID 333 Errors.

Finally - note the data (formatted as Words). I've only ever seen the ntstatus value of c000014d. This maps to STATUS_REGISTRY_IO_FAILED, which tells me nothing that hasn't already been written in plain English - but you might find another status on your systems that gives you a little more insight into the kind of issue you're facing. Also - check the ntstatus values on other related events. I have seen this event coincide with some NTFS event ID 55 entries. These had the ntstatus of c0040037, which maps to STATUS_PNP_IRQ_TRANSLATION_FAILED - which tells you a little more about what to look for in the debugger.