This rule generates alerts base on system events that indicates a NTFS File System Corruption.
NTFS has reported that the logical disk is either corrupted or completely unavailable. Some data stored on the volume may be inaccessible.
A logical disk may become corrupted or inaccessible due to a number of reason some of which may include:
A physical disk related to the logical disk has been removed or failed.
A physical disk related to the logical disk has become corrupt.
The disk may have encountered an issue.
Check the status of your hardware for any failures. In most cases, the system log contains additional events from the lower level storage drivers that indicate the cause of the failure.
After you have isolated and resolved the hardware problem:
1. Open the disk management snap in.
2. Rescan the disks then reactivate any disks with errors. Resynchronize or regenerate the volume as necessary if the disk was a member of a mirrored or RAID – 5 volume.
3. Run fsutil repair state on the volume and that will tell you the current health state of the volume.
4. If required, For State (1) Pro-scan Needed – Run Chkdsk /scan on any reactivated volume.
5. If required, For State (2) Spot Fix Needed – Run Chkdsk /spotfix on any reactivated volume.
6. If required, For State (3) Full Check Disk Needed – Run chkdsk/f on any reactivated volume. on any reactivated volume.
Target | Microsoft.Windows.Server.10.0.LogicalDisk | ||
Category | EventCollection | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | System |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
EventDS | DataSource | Microsoft.Windows.EventProvider | Default |
GenerateAlert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="Microsoft.Windows.Server.10.0.LogicalDisk.NTFSFileSystemCorrupt.Alert" Enabled="true" Target="ServervNext!Microsoft.Windows.Server.10.0.LogicalDisk" ConfirmDelivery="true">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventSourceName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Microsoft-Windows-Ntfs</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">98</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Value Type="String">$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/Name$</Value>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">Params/Param[3]</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">Params/Param[3]</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">2</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">Params/Param[3]</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">3</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.10.0.LogicalDisk.NTFSFileSystemCorrupt.Alert.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
<AlertParameter2>$Data/Params/Param[1]$</AlertParameter2>
<AlertParameter3>$Data/Params/Param[2]$</AlertParameter3>
<AlertParameter4>$Data/Params/Param[3]$</AlertParameter4>
</AlertParameters>
</WriteAction>
</WriteActions>
</Rule>