Home
  •  

Corruptions Found

Microsoft.Windows.FileServices.Service.Deduplication.6.2.CorruptionsFound (Rule)

Knowledge Base article:

Summary

Corruptions were detected on this volume. Some file access failures are expected.

Causes

Corruptions can occur due to a variety of hardware or software errors which lead saved data to silently change.

Resolution

Check the Scrubbing log in the Event Viewer under Microsoft->Windows->Deduplication and run Scrubbing in -full and optionally in -readonly mode using the Start-DedupJob powershell cmdlet to ensure any silent corruptions on the volume are detected, reported and possible repaired. Run chkdsk on the volume to scan and report any file system issues. Restore corrupted files from backup and consider checking and replacing the disk drives hosting the volume.

Additional

Deduplication Cmdlets in Windows PowerShell (http://go.microsoft.com/fwlink/?LinkId=255899)

Element properties:

TargetMicrosoft.Windows.FileServices.Service.Deduplication.6.2.Volume
CategoryAvailabilityHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Corruptions Found
Deduplication on computer {0} has found corruptions on volume '{1}'.
Event LogMicrosoft-Windows-Deduplication/Scrubbing

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.FileServices.Service.Deduplication.6.2.CorruptionsFound" Target="Microsoft.Windows.FileServices.Service.Deduplication.6.2.Volume" Remotable="true" Enabled="true">

  <Category>AvailabilityHealth</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Microsoft-Windows-Deduplication/Scrubbing</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-Deduplication</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">12805</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[2]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">$Target/Property[Type='Microsoft.Windows.FileServices.Service.Deduplication.6.2.Volume']/VolumeId$</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServices.Service.Deduplication.6.2.CorruptionsFound.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter1>

        <AlertParameter2>$Target/Property[Type="Microsoft.Windows.FileServices.Service.Deduplication.6.2.Volume"]/Volume$</AlertParameter2>

      </AlertParameters>

      <Suppression/>

    </WriteAction>

  </WriteActions>

</Rule>