840165 Event ID 8 appears in the system event log after you break a mirrored > http://support.microsoft.com/?id=840165 After you create a software RAID volume in Microsoft Windows Server 2003, when you break that volume, the following event appears in the system event log: Event Type: Error Event Source: Volsnap Event Category: None Event ID: 8 Date: date Time: time User: N/A Computer: computername Description: The flush and hold writes operation on volume C: timed out while waiting for a release writes command. The event 12 or event 14 may also have added entries into the event view. > > In addition, please also monitor the event error message related with disk > failure, there might also related with software Raid. ----------------------------------------------------- As you want to change the email notification for some certain event, I suggest you follow the steps below: 1. Run the eventvwr, create a new log files filter the event you want to monitor. 2. Save the new log files. 3. In the Monitoring and Reporting snap in, choose "Server status reports" 4. Choose "Server Performance Report" and click Edit. 5. In the content Tab, click "add", choose the log files you just create. 6. Choose appropriate Email address you want to send "Report to". ----------------------------------------------------- http://www.monitorware.com/common/en/articles/software_raid_monitoring_windows_2003.php Event ID 1: "dmboot: Volume %2 (no mountpoint) started in failed redundancy mode." Event ID 2: "dmboot: Volume %2 (%3) started in failed redundancy mode." Event ID 3: "dmboot: Failed to start volume %2 (%3)" Event ID 4: "dmboot: Failed to encapsulate selected disks" Event ID 5: "dmboot: Disk group %2 failed. All volumes in the disk group are not available." Event ID 6: "dmboot: Failed to auto-import disk group %2. All volumes in the disk group are not available." Event ID 7: "dmboot: Failed to restore all volume mount points. All volume mount points may not be available. %2" Event ID: 1, "dmio: Device %2,%3: Received spurious close" Event ID: 2, "dmio: Failed to log the detach of the DRL volume %2" Event ID: 3, "dmio: DRL volume %2 is detached" Event ID: 4, "dmio: %2 error on %3 %4 of volume %5 offset %6 length %7" Event ID: 5, "dmio: %2 %3 detached from volume %4" Event ID: 6, "dmio: Overlapping mirror %2 %3 detached from volume %4" Event ID: 7, "dmio: Kernel log full: %2 %3 detached" Event ID: 8, "dmio: Kernel log update failed: %2 %3 detached" Event ID: 9, "dmio: detaching RAID-5 %2" Event ID: 10, "dmio: object %2 detached from RAID-5 %3 at column %4 offset %5" Event ID: 11, "dmio: RAID-5 %2 entering degraded mode operation" Event ID: 12, "dmio: Double failure condition detected on RAID-5 %2" Event ID: 13, "dmio: Failure in RAID-5 logging operation" Event ID: 14, "dmio: log object %2 detached from RAID-5 %3" Event ID: 15, "dmio: check_ilocks: stranded ilock on %2 start %3 len %4" Event ID: 16, "dmio: check_ilocks: overlapping ilocks: %2 for %3, %4 for %5" Event ID: 17, "dmio: Illegal vminor encountered" Event ID: 18, "dmio: %2 %3 block %4: Uncorrectable %5 error" Event ID: 19, "dmio: %2 %3 block %4:\r\n Uncorrectable %5 error on %6 %7 block %8" Event ID: 20, "dmio: Cannot open disk %2: kernel error %3" Event ID: 21, "dmio: Disk %2: Unexpected status on close: %3" Event ID: 22, "dmio: read error on object %2 of mirror %3 in volume %4 (start %5, length %6) corrected" Event ID: 23, "dmio: Reassigning bad block number %2 on disk %3" Event ID: 24, "dmio: Reassign bad block(s) on disk %2 succeeded" Event ID: 25, "dmio: Fail to reassign bad block(s) on disk %2: error 0x%3" Event ID: 26, "dmio: Found a bad block on disk %2 at block number %3" Event ID: 27, "dmio: Corrected a read error during RAID5 initialization on %2" Event ID: 28, "dmio: Failed to recover a read error during RAID5 initialization on %2: error %3" Event ID: 29, "dmio: %2 read error at block %3: status 0x%4" Event ID: 30, "dmio: %2 write error at block %3: status 0x%4" Event ID: 31, "dmio: %2 write error at block %3 due to disk removal" Event ID: 32, "dmio: %2 read error at block %3 due to disk removal" Event ID: 33, "dmio: %2 is disabled by PnP" Event ID: 34, "dmio: %2 is re-online by PnP" Event ID: 35, "dmio: Disk %2 block %3 (mountpoint %4): Uncorrectable read error" Event ID: 36, "dmio: %2 %3 block %4 (mountpoint %5): Uncorrectable read error" Event ID: 37, "dmio: Disk %2 block %3 (mountpoint %4): Uncorrectable write error" Event ID: 38, "dmio: %2 %3 block %4 (mountpoint %5): Uncorrectable write error" ----------------------------------------------------- http://www.anchor.com.au/hosting/dedicated/recovering_from_windows_software_raid_failure ----------------------------------------------------- http://tim.mackey.ie/HowToSetUpDiskStatusMonitoringIeForARaidArrayAndSendResultsByEmail.aspx HowTo: set up disk status monitoring (i.e. for a raid array) and send results by email Wednesday, May 18, 2005 5:39:12 PM UTC ( Windows Server 2003 ) background i have a raid 1 array on my server, and i was surprised to see no easy solution to setting up an email alert if one of the disks should fail. luckily it has never happened but apparently windows doesn't even pop up a task-bar alert if it happens. what doesn't work i tried the Windows performance monitoring and alerts, and while it can tell you the average read/writes per second, it can't tell you how many disks are online. so i looked into WMI which has an API for hard disks, but i encountered a problem with the API not returning the information it is supposed to for disk status. enter DiskPart.exe then i discovered DiskPart.exe, a powerful disk management utility bundled with windows server 2003, i think you can get it for server 2000 too with an admin pack or something. you can run DiskPart.exe from the command prompt, type: "Select Disk 0" then hit return, next type "Detail Disk" and hit return. you should see a list of all the volumes on the disk, along with the disk status "Healthy". In the case of a raid array, i found it more useful to run the following commands: select disk 0 select volume 0 detail volume this outputs all the disks that make up the volume (Disk 0 and 1, in my case), and their status. Fortunately, you can pipe the output of DiskPart to a text file, and you can also tell DiskPart to run a list of commands from a script, so the whole thing can be automated as a scheduled task in Windows. I also wrote a simple c# console app to send the contents of the output file in an email. The .cmd file i have scheduled contains the following lines: @diskpart /s c:\Scripts\disk_part_commands.txt > c:\scripts\disk_status.txt @SendMail server@whatever.ie tim@whatever.ie "Server Disk Status" c:\scripts\disk_status.txt The SendMail program takes in the following parameters: from address, to address, email subject, text file path. it is hard coded to use the localhost mail server which you can change if you want in the source code (.Net C#). Download the send mail console app: SendMail.exe (16 KB) Download the send mail source code: SendMail.txt (1.26 KB) Taking it further if i was really serious about it, i would parse the text file and read in the status directly, and only send the email if the status is something other than 'Healthy', but i think it's nice to get an email once a week anyway from the server, reporting it's disk status and letting you know it is still alive. if somebody does write a little program to parse the output, you could post it here as a comment, that would be great. i run the script every week, so in the worst case it could operate for 7 days with a dead drive, and the chance is very slim that the other drive will fail within this time. ----------------------------------------------------- Diskpart command line utility http://support.microsoft.com/kb/300415