NT file system indicates a corrupt file system.
The file system on the volume might be corrupt due to one or more of the following reasons:
The disk might have bad sectors.
I/O requests issued by the file system to the disk subsystem might not have been completed successfully.
The disk might have bad sectors.
I/O requests issued by the file system to the disk subsystem might not have been completed successfully.
Check the state of the file system and repair it if necessary.
To check the state of the file system
At a command prompt, type chkntfs %drive letter:%
Check the message from chkntfs.
If chkntfs displays the message “%drive letter%: is dirty”, the volume is corrupt. In this case, repair the file system using the chkdsk /r command.
If chkntfs displays the message “%drive letter%: is not dirty”, the volume is not corrupt and no further action is required.
To repair the file system
Save any unsaved data, close any open programs, and restart the computer.
Windows automatically runs chkdsk /r on “dirty” (corrupt) volumes to check and repair them.
You can also run chkdsk manually using the following steps.
At a command prompt, type chkdsk /x %drive letter%:
Chkdsk runs and automatically repairs the volume.
If chkdsk displays the following message, type Y.
“Cannot lock current drive. Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts?”
Windows will automatically run chkdsk the next time the computer is started.
If you regularly see NTFS Event ID 41 or Event ID 55 in Event Viewer, run chkdsk using the /r option. This option allows chkdsk to locate bad sectors on the hard disk.
For more information about the chkdsk /c and /i switches, see Knowledge Base article 187941 “An Explanation of CHKDSK and the New /C and /I Switches” at http://go.microsoft.com/fwlink/?LinkId=25770.
For more information about NTFS recoverability, see Knowledge Base article 101670 “Transaction Log Supports NTFS Recoverability,” at http://go.microsoft.com/fwlink/?LinkId=25981.
Target | Microsoft.Windows.Server.2008.OperatingSystem | ||
Category | EventCollection | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | System |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
EventDS | DataSource | Microsoft.Windows.EventProvider | Default |
GenerateAlert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="Microsoft.Windows.Server.2008.OperatingSystem.NTFSFileSystemCorrupt.Alert" Enabled="onEssentialMonitoring" Target="Server2008!Microsoft.Windows.Server.2008.OperatingSystem" ConfirmDelivery="true">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventSourceName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>DISK</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventSourceName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Ntfs</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>41</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.2008.OperatingSystem.NTFSFileSystemCorrupt.Alert.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue/>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>