NTFS Event ID 137 with error code 0xC00000BB may be logged when a pair of hardware-RAID volumes are repeatedly mounted and unmounted.

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

When you use a script to repeat the following procedure, NTFS Event ID 137 with error code Code 0xC00000BB may be logged into the System Event Log.

�

1) The secondary volume is unmounted with mountvol /P.

2) An application writes data to the primary volume.

3) The primary volume is unmounted with mountvol /P.

4) The hardware-RAID system starts to synchronize the paired volumes.

5) The pair is splitted. (which means that the RAID system stops the synchronization.)

6) The secondary volume is mounted with mountvol.

7) The primary volume is mounted with mountvol.

8) The data in the primary volume and the secondary volume are accessed.

�� (For example, the data in the primary volume are compared with the ones in the secondary volumes with fc.exe.)

�

The NTFS transaction feature does not function on these volumes after the error event occurs. If you reverse the step 6 and 7 , the problem may occur much less frequently than the above steps, but it still might occur.

�

This problem occurs because Common Log File System driver (CLFS.SYS) does not properly handle a name conflict in the transaction log.

Because the primary and secondary volumes have the same log name resulting from the synchronization at step 4, mounting again the primary at step 7 after mounting the secondary causes the log name confliction. This confliction remains unsolved because CLFS.SYS does not delete the conflicting entry but keeps creating new entries. At the next loop, the primary volume is copied to the secondary and so is the log entry list. When the above script keeps running for a while, the log entry lists for both of the primary and the secondary will be fully occupied by the conflicting entries, and no more log entry can be allocated for a new request. When this occurs, NTFS Event ID 137 with error code 0xC00000BB is logged.

To resolve this problem, follow these steps:

�

1. Reboot the machine.

2. Modify your script as follows:

�� 2-1) Reverse step 6 and 7, so that the primary volume is always mounted before the secondary volume.

�� 2-2) For both step 6 and 7, add a command (e.g. DIR) to access the volume after calling mountvol.�

�

With the steps above to stop replicating the log entries, the entry list of CLFS.SYS will not become full.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE �MATERIALS�) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.