Windows Server 2016 and above NTFS File System Corrupt Rule

Microsoft.Windows.Server.10.0.LogicalDisk.NTFSFileSystemCorrupt.Alert (Rule)

This rule generates alerts base on system events that indicates a NTFS File System Corruption.

Knowledge Base article:

Summary

NTFS has reported that the logical disk is either corrupted or completely unavailable. Some data stored on the volume may be inaccessible.

Causes

A logical disk may become corrupted or inaccessible due to a number of reason some of which may include:

A physical disk related to the logical disk has been removed or failed.
A physical disk related to the logical disk has become corrupt.
The disk may have encountered an issue.

Resolutions

Check the status of your hardware for any failures. In most cases, the system log contains additional events from the lower level storage drivers that indicate the cause of the failure.

After you have isolated and resolved the hardware problem:

1. Open the disk management snap in.
2. Rescan the disks then reactivate any disks with errors. Resynchronize or regenerate the volume as necessary if the disk was a member of a mirrored or RAID – 5 volume.
3. Run fsutil repair state on the volume and that will tell you the current health state of the volume.
4. If required, For State (1) Pro-scan Needed – Run Chkdsk /scan on any reactivated volume.
5. If required, For State (2) Spot Fix Needed – Run Chkdsk /spotfix on any reactivated volume.
6. If required, For State (3) Full Check Disk Needed – Run chkdsk/f on any reactivated volume. on any reactivated volume.

Element properties:

Target

Microsoft.Windows.Server.10.0.LogicalDisk

Category

EventCollection

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

Windows Server 2016 and above NTFS File System Corrupt

The Drive {1} of the Device Named as {2} reports a Corruption Action State of {3}. Event Description: {0}.

Event Log

System

Member Modules:

ID	Module Type	TypeId	RunAs
EventDS	DataSource	Microsoft.Windows.EventProvider	Default
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Windows.Server.10.0.LogicalDisk.NTFSFileSystemCorrupt.Alert" Enabled="true" Target="ServervNext!Microsoft.Windows.Server.10.0.LogicalDisk" ConfirmDelivery="true">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventSourceName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Microsoft-Windows-Ntfs</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">98</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <Value Type="String">$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/Name$</Value>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <Or>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">Params/Param[3]</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">1</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">Params/Param[3]</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">2</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">Params/Param[3]</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">3</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </Or>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.10.0.LogicalDisk.NTFSFileSystemCorrupt.Alert.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

        <AlertParameter2>$Data/Params/Param[1]$</AlertParameter2>

        <AlertParameter3>$Data/Params/Param[2]$</AlertParameter3>

        <AlertParameter4>$Data/Params/Param[3]$</AlertParameter4>

      </AlertParameters>

    </WriteAction>

  </WriteActions>

</Rule>