Kaseya Community

The device, \Device\Harddisk0\D, has a bad block

  • Hello to all,

    We just activated Event Log Monitoring for an event set that includes watching for events in the System Log, Event=7, Source=Disk, description=*has a bad block*

    This was applied to about 500 Agents yesterday, and plan to apply to another 500 or so next week.

    We received 50+ alerts/emails over the past 24 hours. Looking into each one, we found that a few were for hard disk drives (which I certainly care about), but the vast majority were for CD drives (which I do not care about).

    I am looking for a little advice from others who have been monitoring for this event. How do you handle these? It seems we will be spending a lot of time chasing alerts for the CD drives.

    I can not figure out a way (or an easy way) to watch for this event for hard disk drives, but not for CD drives - as some machines have a hard drive for D, while others have a CD-drive for D.

    Any advice is appreciated. Thanks in advance.

    Lloyd

    Here is an example of the Alert
    =========================
    System log generated Error Event 7 on ws11.companyname For more information see http://www.eventid.net/display.asp?eventid=7&source=Disk
    Log: System
    Type: Error
    Event: 7
    Agent Time: 9:19:44 am 10-Sep-08
    Event Time: 1:19:44 pm 10-Sep-08 UTC
    Source: Disk
    Category: None
    Username: N/A
    Computer: WS11
    Description: The device, \Device\Harddisk0\D, has a bad block.
    =========================

    Legacy Forum Name: The device, \Device\Harddisk0\D, has a bad block,
    Legacy Posted By Username: lwolf
  • lwolf
    Hello to all,

    We just activated Event Log Monitoring for an event set that includes watching for events in the System Log, Event=7, Source=Disk, description=*has a bad block*

    This was applied to about 500 Agents yesterday, and plan to apply to another 500 or so next week.

    We received 50+ alerts/emails over the past 24 hours. Looking into each one, we found that a few were for hard disk drives (which I certainly care about), but the vast majority were for CD drives (which I do not care about).

    I am looking for a little advice from others who have been monitoring for this event. How do you handle these? It seems we will be spending a lot of time chasing alerts for the CD drives.

    I can not figure out a way (or an easy way) to watch for this event for hard disk drives, but not for CD drives - as some machines have a hard drive for D, while others have a CD-drive for D.

    Any advice is appreciated. Thanks in advance.

    Lloyd

    Here is an example of the Alert
    =========================
    System log generated Error Event 7 on ws11.companyname For more information see http://www.eventid.net/display.asp?eventid=7&source=Disk
    Log: System
    Type: Error
    Event: 7
    Agent Time: 9:19:44 am 10-Sep-08
    Event Time: 1:19:44 pm 10-Sep-08 UTC
    Source: Disk
    Category: None
    Username: N/A
    Computer: WS11
    Description: The device, \Device\Harddisk0\D, has a bad block.
    =========================


    You can't go by that as the drive letter. It confused us at first, too. You have to use DMDIAG from the Support Tools to determine which one has a problem or you can run chkdsk against all drives in read-only mode. To run DMDIAG, you will need the file on the computer and then run

    DMDIAG -F and then you can get that file to see to which drive the error is referring. (You might have to use DMDIAG -V -F to get the necessary info - I can't remember.)

    If this was an error generated by a CDROM, the Source would be CDROM. We filter out that source for these errrors because they happen way too often and could be because of user error (taking out a CD while reading from it, for example).

    Michael

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: RCS-Michael
  • Michael,

    Hello. Thanks so much for replying.

    Call me stupid, but I am confused. I suppose i need to Google DMDIAG to get some more info.

    Do you run DMDIAG one time, in advance, and that changes the Source of the Event Log errors? Of do you run DMDIAG via script after a Bad Block event occurs to try to get mroe info about where it came from? or something else?

    Any additional information you could provide would be greatly appreciated. Thanks!

    Lloyd

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: lwolf
  • The \D does not indicate drive letter. The only clue you have from the description is that it will say "Harddiskx" or "CDROMx" (where x is a number). X would indicate which drive it is that has the bad block.

    We're ignoring events where the CDROM has the bad block. We really don't care if someones "Johnny Cash Greatest Hits" is skipping on "A man named Sue"...

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: Lmhansen
  • lwolf
    Michael,

    Hello. Thanks so much for replying.

    Call me stupid, but I am confused. I suppose i need to Google DMDIAG to get some more info.

    Do you run DMDIAG one time, in advance, and that changes the Source of the Event Log errors? Of do you run DMDIAG via script after a Bad Block event occurs to try to get mroe info about where it came from? or something else?

    Any additional information you could provide would be greatly appreciated. Thanks!

    Lloyd


    You run DMDIAG on the computer that generated the alert and it will help you identify the disk to which the alert is referring.

    Michael

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: RCS-Michael
  • Michael and Lmhansen,

    Thanks very much for the extra info. I re-read Micahe's original reply post, and your two new posts, and it now makes total sense. I think I must have just been tored when I read it yesterday.

    So Source=Disk and \Device\Harddisk0\ tell us that it is an issue with the hard disk drive. If it were the CD drive, the source would be "CDROM" and the description would include "CDROMx"

    For kicks, I downloaded and ran DMDIAG. But I still can not figure out exactly what the \D means. Any chance you might know?

    Lloyd

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: lwolf
  • It always says \D, so I've never worried about it ...

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: Lmhansen
  • I am pretty sure that the '\D' is referring to the partition on the drive that has the bad block. Also be aware that when it reports "has A bad block" - there may be more than one bad block found.

    could be wrong.... so check it out.

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: george
  • Search the manufacturer's website and look for updated ICH and AHCI chipset drivers.

    Legacy Forum Name: Event Sets,
    Legacy Posted By Username: jbock@integrityrochester.com