Aggregate Repaired with Reboot Corrupted System File Monitor

Microsoft.Windows.Client.Vista.PhysicalDisk.COFIRE_FixedR.Monitor (UnitMonitor)

Monitor reports when the Corrupted File Recovery server repairs a corrupted file and requires a reboot

Knowledge Base article:

Summary

This Health monitor turns YELLOW when Windows Vista detects bad sectors in OS section of the system drive and has been able to self-heal the drive. While Windows Vista was able to recover from the hardware error, the hard drive is highly likely to develop other bad sectors which could result in loss of data.

Resolutions

1.Run ChkDsk on the drive to gauge extent of bad blocks

2.Consider replacing the hard drive

Element properties:

Target

Microsoft.Windows.Client.Vista.Aggregate.PhysicalDisk

Parent Monitor

System.Health.AvailabilityState

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Low

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.SingleEventLogManualReset2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

A Windows Vista computer has a corrupted system file that was repaired

Windows Vista has detected a corrupted system file that it self-healed. There is no direct action to be taken. However, if this problem persists and there are further bad sectors in the hard drive, please consider replacing the hard drive. Please look at the health state of the machine to better understand what other related hard drive issues are being encountered by Windows Vista.

RunAs

System.PrivilegedMonitoringAccount

Source Code:

<UnitMonitor ID="Microsoft.Windows.Client.Vista.PhysicalDisk.COFIRE_FixedR.Monitor" RunAs="System!System.PrivilegedMonitoringAccount" Accessibility="Public" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Target="Microsoft.Windows.Client.Vista.Aggregate.PhysicalDisk" TypeID="Windows!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" Remotable="true" Enabled="true" Priority="Normal" ConfirmDelivery="false">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.Client.Vista.PhysicalDisk.COFIRE_FixedR.Monitor.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Low</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="NoProblem" HealthState="Success" MonitorTypeStateID="ManualResetEventRaised"/>

    <OperationalState ID="ProblemFixed" HealthState="Error" MonitorTypeStateID="EventRaised"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>

    <LogName>System</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>Microsoft-Windows-CorruptedFileRecovery-Server</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>8</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value>$Target/Property[Type="Microsoft.Windows.Client.Vista.Aggregate.PhysicalDisk"]/ContainsSystemDrive$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>1</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

  </Configuration>

</UnitMonitor>