Disk Health - Bad Sectors Detected

UIGeneratedMonitord1cf0e5b735b45cbacc0ea052fbcb163 (UnitMonitor)

This health warning condition indicates at least one, but fewer than 50, bad sector has been detected on a disk in the computer. The event log specifies which disk by physical path and model. (If the disk is an SSD, this warning has a higher bad sector tolerance before appearing.)

Knowledge Base article:

Summary

Bad sectors are physical defects in the disk media that cannot be read or written. The disk’s firmware has reallocated the data to a spare sector. This is a permanent operation. Once a sector is marked as “bad” it cannot become a “good” sector again.

Bad sectors on a hard disk are one of the most common early warning signs of disk failure, especially if a head crash (the read/write head touched the disk surface during disk operation) occurred. If you see bad sectors appear, and the count of them remains constant, keep a close eye on the disk. If the count increases, replace the disk. Bad sectors on a solid state disk (SSD) are generally less serious than on a hard disk, since SSDs are not mechanical; for this reason WindowSMART’s tolerance for bad sectors on an SSD is much higher.

Configuration

Bad sectors are managed by the disk firmware.

Causes

Bad sectors can be the result of a manufacturing defect. However, in many cases their appearance is one of the most common early warning signs of disk failure. While one or even a handful of bad sectors may not seem serious, you should keep a close eye on the disk, especially if you find the count consistently climbing.

Resolutions

Keep a close eye on the disk. If the bad sector count gets too high, WindowSMART will flag the disk as critical, even if the bad sector count is within manufacturer limits. Large numbers of bad sectors, or a bad sector count that is steadily increasing in small increments is a strong indicator the disk is getting ready to fail.

If you see just one, or a small handful, of bad sectors appear on a hard disk, and then that number remains constant (doesn’t increase), you may want to favor a “watchful waiting” approach, rather than replacing the disk. However, if you notice the bad sector count increases, whether in small increments or large ones, you should strongly consider replacing the disk, as a continuously increasing bad sector count is a strong indicator the disk will fail soon.

Additional

The SMART specification defines reallocated sectors as follows: Count of reallocated sectors. When the hard drive finds a read/write/verification error, it marks this sector as "reallocated" and transfers data to a special reserved area (spare area). This process is also known as remapping, and "reallocated" sectors are called remaps. This is why, on modern hard disks, "bad sectors" cannot be found while testing the surface – all bad blocks are hidden in reallocated sectors. However, as the number of reallocated sectors increases, the read/write speed tends to decrease. The raw value normally represents a count of the number of bad sectors that have been found and remapped. Thus, the higher the attribute value, the more sectors the drive has had to reallocate.

External

SMART on Wikipedia: http://en.wikipedia.org/wiki/S.M.A.R.T

Failure Trends in a Large Disk Drive Population (Google Research): http://research.google.com/pubs/pub32774.html

Element properties:

TargetMicrosoft.Windows.Computer
Parent MonitorAggregateMonitor000add34203e4a45bf54c429e630306e
CategoryCustom
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.SingleEventLogManualReset2StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Disk Health - Bad Sectors Detected
Event Description: {0}
RunAsDefault

Source Code:

<UnitMonitor ID="UIGeneratedMonitord1cf0e5b735b45cbacc0ea052fbcb163" Accessibility="Public" Enabled="true" Target="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer" ParentMonitorID="AggregateMonitor000add34203e4a45bf54c429e630306e" Remotable="true" Priority="Normal" TypeID="MicrosoftWindowsLibrary6172210!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" ConfirmDelivery="true">
<Category>Custom</Category>
<AlertSettings AlertMessage="UIGeneratedMonitord1cf0e5b735b45cbacc0ea052fbcb163_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateIde8caf2ad9eb3442b9e706bb694010c97" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>
<OperationalState ID="UIGeneratedOpStateIdff0f8715076d4275ac4d7af3fc779926" MonitorTypeStateID="EventRaised" HealthState="Warning"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Property[Type="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">53831</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">TarynHss</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</Configuration>
</UnitMonitor>