How to find the cause of CSV redirection ??

Avagon Zales 40 Reputation points
2026-09-01T08:31:35.2533333+00:00

Hi support team

CSV volumes are switching from Direct I/O to Block Redirected Mode unexpectedly.

Cluster traffic increases across the CSV interconnect during I/O operations. A storage or filter driver may be forcing the CSV into redirected access mode.

Note: We recently saw a CSV volume switch to Block Redirected Mode after a storage filter driver update, causing noticeably higher network traffic and slower disk performance.

How can we identify which storage or filter driver is triggering the CSV redirection and confirm the root cause ?

Windows for business | Windows 365 Business
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-01T08:32:07.9233333+00:00

    Use the CSV state and the related cluster/system events to confirm both the redirection mode and the reason, then inspect storage and filter-driver changes around the same time.

    1. Check the CSV state per node. On a cluster node, run Get-ClusterSharedVolumeState. In Windows Server 2012 R2 and later, this shows whether I/O is direct, redirected, or unavailable on a per-node basis. If the CSV is in redirected I/O mode, it also shows the reason.
    2. Confirm whether the redirection is block redirection. CSV uses:
      • File system redirection for cases such as CSV snapshots or when a CSV is manually placed in redirected mode.
      • Block redirection when storage connectivity is lost to a volume. If the volume is specifically in Block Redirected Mode, that points to a storage-path or storage-access problem rather than a normal snapshot-related file-system redirection scenario.
    3. Correlate with cluster and storage events. Review System and Application logs for CSV-related events around the time the mode changed. Relevant symptoms include Event ID 5120, 5142, and 153 with messages such as: "All I/O will temporarily be queued until a path to the volume is reestablished." For Event ID 5120 guidance, the documented meaning is that communication between a cluster node and a CSV was interrupted. If the interruption persists, review other System or Application events for communication problems between the node and the volume.
    4. Check whether the volume is still online from the cluster perspective. In Failover Cluster Manager, inspect the affected volume status. If needed, verify with Get-ClusterSharedVolume. This confirms whether the issue is only redirection or whether the CSV is also transitioning offline/unavailable.
    5. Investigate the most common root-cause areas that force CSV into redirected access. The documented causes include:
      • Network bottleneck or misconfiguration, including network adapter teaming mismatch. Validate teaming consistency on all nodes with Get-NetLbfoTeam.
      • Network adapter resource exhaustion, including Event ID 252 warnings.
      • Physical disk or HBA failure. Review disk health with Get-PhysicalDisk | Format-Table and check for Event ID 157.
      • Switch or cable faults in the storage fabric.
      • Incorrect or corrupt MPIO configuration. Confirm all paths are online with mpclaim -s -d.
      • Outdated or incorrect storage drivers, SAN firmware, DSM/MPIO software.
      • Multiple antivirus or unsupported filter drivers. Inspect loaded filter drivers with fltmc.
    6. Focus on the recent storage filter driver update. Since the issue started after a storage filter driver update, compare the timing of that update with the first redirected-mode events. The documented guidance specifically calls out unsupported filter drivers as a common cause area. If multiple antivirus products or unsupported filter drivers are present, remove the unsupported ones and keep only one antivirus product.
    7. Validate cluster-network behavior during redirection. Increased traffic on the CSV interconnect is expected during redirected I/O because disk I/O is sent over a cluster network to the coordinator node. CSV traffic can also stream across multiple cluster networks through SMB Multichannel and SMB Direct. This confirms the symptom, but not the cause.
    8. Check platform and formatting considerations. If the CSV is ReFS on SAN-attached disks, Direct I/O is not used. The documented guidance states that CSVs preformatted with ReFS on top of SANs will not use Direct I/O, regardless of other Direct I/O requirements. For SAN-attached CSV disks, NTFS is required before converting to CSV to leverage Direct I/O. If the affected volume is ReFS on a SAN, that behavior must be ruled out before attributing the issue to a driver.
    9. Update the full storage and network stack. Make sure the affected systems have the latest network drivers, storage drivers, firmware, and applicable Microsoft updates/hotfixes installed.

    The practical way to confirm the root cause is:

    • Use Get-ClusterSharedVolumeState to capture the CSV redirection reason.
    • Correlate that timestamp with Event IDs 5120/5142/153 and any Event ID 252/157 entries.
    • Inspect fltmc output and recent filter-driver changes.
    • Validate MPIO paths, HBA/disk health, teaming consistency, and switch/cable health.
    • If the volume is ReFS on SAN-attached storage, account for the documented Direct I/O limitation first.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Domic Vo 32,140 Reputation points Independent Advisor
    2026-09-01T09:15:30.4466667+00:00

    Hello,

    CSV volumes switching into Block Redirected Mode is always a sign that something in the I/O path is interfering with direct disk access. In most cases this is triggered by a storage filter driver or antivirus driver update. To identify which driver is responsible, you need to look at the filter stack attached to the CSV volume and correlate it with the timing of the redirection.

    On the affected cluster nodes, run fltmc filters to list all active filter drivers. Pay close attention to any non‑Microsoft filters that were recently updated, such as storage multipath drivers, antivirus, backup agents, or deduplication filters. You can also run fltmc instances to see which filters are attached to the CSV volume specifically. If you see a third‑party driver bound to the volume, that is the most likely cause of the forced redirection.

    In addition, check the System event log for CSVFS events (source: Microsoft-Windows-FailoverClustering, event IDs 5120 and 5142). These events will explicitly state when the volume switched to redirected mode and often include the driver or condition that triggered it. If you want deeper tracing, enable cluster debug logging with cluster log /gen and review the CSV sections for redirection triggers.

    Once you confirm the driver, the remediation is either to roll back the update, apply the vendor’s hotfix, or adjust the driver’s configuration so it does not intercept CSV I/O. Microsoft’s guidance is clear: any filter driver that forces CSV into redirected mode will degrade performance, so the long‑term fix is to use only drivers certified for Failover Clustering and S2D.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

    Domic Vo.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.