SMB Resume Key Filter ChkDsk Detected

Microsoft.Windows.FileServices.Service.SMB.6.3.ResumeKeyFilterChkDskDetected (UnitMonitor)

Monitors the status of Resume Key Filter database load

Knowledge Base article:

Summary

Resume Key detected CHKDSK has been performed on one or more volumes and has discarded its database for those volumes.

Causes

If an administrator has performed CHKDSK on a volume with continuously available file shares or a full CHKDSK run has automatically been performed, Resume Key will not be able to safely resume opened file handles.

Resolutions

Applications with continuously available handles opened on file shares on the affected volumes will have the handles closed. Once the issue has been resolved, the application administrator will need to take recovery action to reestablish those handles. This could include restarting virtual machines, reattaching databases or restarting the application

Element properties:

Target

Microsoft.Windows.FileServices.Service.SMB.6.3.Clustered

Parent Monitor

Microsoft.Windows.FileServices.Service.SMB.6.3.ContinuousAvailability

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Resume Key detected CHKDSK

Resume Key detected a CHKDSK on one or more volumes and will discard its database for those volumes.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServices.Service.SMB.6.3.ResumeKeyFilterChkDskDetected" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" Accessibility="Public" Target="Microsoft.Windows.FileServices.Service.SMB.6.3.Clustered" ParentMonitorID="Microsoft.Windows.FileServices.Service.SMB.6.3.ContinuousAvailability" Remotable="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServices.Service.SMB.6.3.ResumeKeyFilterChkDskDetected.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="ResumeKeyFilterChkDskDetectedFailed" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="ResumeKeyFilterChkDskDetectedOK" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Microsoft-Windows-ResumeKeyFilter/Operational</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-ResumeKeyFilter</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1010</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Microsoft-Windows-ResumeKeyFilter/Operational</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">Microsoft-Windows-ResumeKeyFilter</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">1002</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>