[German]In Windows 10 cliets as well as in Windows Server 2016 and Windows Server 2019, events with ID 650 may occur in the Event Viewer. Microsoft has provided an explanation for these entries as of August 13, 2020.
Advertising
The support article KB4577004 (title Windows logs multiple events that specify Event ID 640) contains more information. The event entries with Event ID 640 indicate that the Extensible Storage Engine (ESE) has detected that a database file and its flush map file are not synchronized. Microsoft specifies the following scenarios where this can happen:
- The database was moved, but not all required files were moved along with it.
- The sector containing the header of the flush map is corrupted. This condition is extremely rare.
- An existing ESE database was deleted and then recreated, but its flush map file was not deleted or recreated.
This discrepancy from the latter paragraph typically occurs when an application migrates its data from one ESE database to another ESE database and the application is not properly cleaned. Such migrations may occur more frequently during or shortly after a Windows upgrade. After the new database is created, the system detects the old flush map file. This file is not synchronized with the new database. In this scenario, there is no risk to the data in the new database because it is in a benign state.
The event entries with the ID 640 can then be ignored. If Windows logs event ID 640 in a benign case, it may also log event ID 636, in which case you can also ignore event ID 636.
To find out if the event entries with ID 650 are benign, the support post suggests to look at the "…FromDb" fields in the event data The support post KB4577004 the scenarios to be considered for benign entries are mentioned. Microsoft writes that it is planned that a future version of Windows will contain a change that prevents the system from logging event ID 640 in the benign case. (via)
