Disk Health - High Bad Sector Count

UIGeneratedMonitor941896f111b14566a691ad9136e08a0f (UnitMonitor)

This health critical condition indicates more than 50 bad sectors have been detected on a disk in the computer. The event log specifies which disk by physical path and model. (If the disk is an SSD, this critical event has a higher bad sector tolerance before appearing.)

Knowledge Base article:

Summary

Bad sectors are physical defects in the disk media that cannot be read or written. The disk’s firmware has reallocated the data to a spare sector. This is a permanent operation. Once a sector is marked as “bad” it cannot become a “good” sector again

Bad sectors on a hard disk are one of the most common early warning signs of disk failure, especially if a head crash (the read/write head touched the disk surface during disk operation) occurred. If you see bad sectors appear, and the count of them remains constant, keep a close eye on the disk. If the count increases, replace the disk. Bad sectors on a solid state disk (SSD) are generally less serious than on a hard disk, since SSDs are not mechanical; for this reason WindowSMART’s tolerance for bad sectors on an SSD is much higher..

Configuration

Bad sectors are managed by the disk firmware.

Causes

Bad sectors can be the result of a manufacturing defect. However, in many cases their appearance is one of the most common early warning signs of disk failure. While one or even a handful of bad sectors may not seem serious, you should keep a close eye on the disk, especially if you find the count consistently climbing.

Resolutions

You should consider replacing this disk. WindowSMART has already flagged this disk as critical, even if the bad sector count is within manufacturer limits. Large numbers of bad sectors, or a bad sector count that is steadily increasing in small increments is a strong indicator the disk is getting ready to fail.

If you see just one, or a small handful, of bad sectors appear on a hard disk, and then that number remains constant (doesn’t increase), you may want to favor a “watchful waiting” approach, rather than replacing the disk. However, if you notice the bad sector count increases, whether in small increments or large ones, you should strongly consider replacing the disk, as a continuously increasing bad sector count is a strong indicator the disk will fail soon.

Additional

The SMART specification defines reallocated sectors as follows: Count of reallocated sectors. When the hard drive finds a read/write/verification error, it marks this sector as "reallocated" and transfers data to a special reserved area (spare area). This process is also known as remapping, and "reallocated" sectors are called remaps. This is why, on modern hard disks, "bad sectors" cannot be found while testing the surface – all bad blocks are hidden in reallocated sectors. However, as the number of reallocated sectors increases, the read/write speed tends to decrease. The raw value normally represents a count of the number of bad sectors that have been found and remapped. Thus, the higher the attribute value, the more sectors the drive has had to reallocate.

External

SMART on Wikipedia: http://en.wikipedia.org/wiki/S.M.A.R.T

Failure Trends in a Large Disk Drive Population (Google Research): http://research.google.com/pubs/pub32774.html

Element properties:

TargetMicrosoft.Windows.Computer
Parent MonitorAggregateMonitor000add34203e4a45bf54c429e630306e
CategoryCustom
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityHigh
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.SingleEventLogManualReset2StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Disk Health - High Bad Sector Count
Event Description: {0}
RunAsDefault

Source Code:

<UnitMonitor ID="UIGeneratedMonitor941896f111b14566a691ad9136e08a0f" Accessibility="Public" Enabled="true" Target="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer" ParentMonitorID="AggregateMonitor000add34203e4a45bf54c429e630306e" Remotable="true" Priority="Normal" TypeID="MicrosoftWindowsLibrary6172210!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" ConfirmDelivery="true">
<Category>Custom</Category>
<AlertSettings AlertMessage="UIGeneratedMonitor941896f111b14566a691ad9136e08a0f_AlertMessageResourceID">
<AlertOnState>Error</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>High</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateId26da81c455214e2b9d690dc96751f75a" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>
<OperationalState ID="UIGeneratedOpStateIdcf96c95fb4564f3d8540fc87d1b28c17" MonitorTypeStateID="EventRaised" HealthState="Error"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Property[Type="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">53830</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">TarynHss</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</Configuration>
</UnitMonitor>