Logical Disk Availability is critical – what does this mean?


You might have noticed a logical disk availability monitor, being red on some of your systems.


In more recent MP’s – this monitor was renamed to “File System error or corruption”


One of the challenges with this monitor – is that it has really good product knowledge, but the state change context doesn’t give us much to go on:




“BAD” is not enough information really to go do something to a production server.


If you look at the product knowledge – which is pretty good – it mentions

  • Related physical disk has been removed
  • Physical disk has become corrupt (for example; bad sectors) or inoperable
  • Problem with physical disk driver

As to resolutions:

  • Open the Disk Management snap-in.
  • Rescan the disks and then reactivate any disks with errors.
  • Resynchronize or regenerate the volume as necessary if the disk was a member of a mirrored or RAID-5 volume.
  • Run chkdsk on any reactivated volumes.

But what if you didn't see any problems?  Then what?  It’s not like we are going to run off and run a chkdsk on a production server if we don't see anything wrong or know about any previous disk issues.


At that point – it is good to know what this monitor is actually doing.  If you look at the MP in the XML, or follow the Monitor > MonitorType > DataSource in the Authoring Console, you will see this monitor runs a script every 5 minutes (Microsoft.Windows.Server.LogicalDiskHealthCheck.vbs)

While the script does MANY checks… the primary driver of “BAD” state is a single item – a WMI query to the Win32_LogicalDisk class to see if the Volume is marked as dirty.

You check this yourself:

  1. Open WBEMTEST
  2. Connect to root\CIMV2
  3. Select query, and paste in:  “select * from Win32_Volume”  (no quotes)
  4.    (on older operatying systems prior to Server 2003, you would need to run “select * from Win32_LogicalDisk where (DriveType=3 or DriveType=6) and FileSystem != null”  (no quotes)
  5. Select each line that was output by the query with a doubleclick.
  6. On the right side – click SHOW MOF
  7. Scroll all the way down in the list to  “DirtyBitSet”    (or use “VolumeDirty” if you ran the second query for old OS versions)

If DirtyBitSet or VolumeDirty = True, then this monitor will be “Bad”.

What this means is – at some point this volume got a NTFS error, or was removed from the OS in a critical manner.  It *requires* a Chdksk /f to be run against this volume to restore the DirtyBitSet or VolumeDirty to a FALSE condition.

So – if you see these – you can double check this by running the simple WMI query… and then just schedule a Chkdsk on the volume during the next available maintenance window.

Comments (14)

  1. Kevin Holman says:

    @Jason – what do you mean?  Give me a scenario.  I don't think we changed anything here.

  2. Troy08 says:


    How can i generate a performance report for logical disk – Avg. Disk sec/Write per day?



  3. Byty says:

    Hi, a chkdsk does miracles on this error!

  4. SWA_Scott says:

    Hey Kevin, what would cause this property to return bad if there is no volumedirty in the MOF and the the property is "null" and the machine is a virtual win2008r2 server?

  5. vijayh says:

    I would require disk space report like total space free space and % free space in report. Is it possible to do that? My management is eating my head to get this from SCOM. Please help me here.

    Any help would be really appreciated.

  6. vijayh says:

    Any help please for disk space report in the format like Total space, free space and % free space from SCOM 2007 R2

  7. Jason says:

    I want the old Monitor back. At least it could detect whether the drive is there or not. I have tested this tons of times and it does not work!

  8. Dominique says:


    I ran the WBEMTEST with the query and nothing is showing red but the Monitor is still flipping to Critical Alert every 2-3 days….

    Any other step to locate the error?



  9. nelson says:

    Hello – how would one use the WBEMTEST utility for a drive mounted to a folder. We have an F: drive with several drives mounted as folders. SCOM is complaining about one of this mount points – yet it is up and accessbile via Windows Explorer. When I run
    the WBEMTest utility using your instructions, all I see are the C, D, and F drives – not the mount points on the F drive. I tried removing the where (DriveType=3 or DriveType=6) filter, but that had no affect.

  10. SRee says:

    The alert received form the server which is running FAT32 files system. performed the steps provide the knowledge tab. Reported no errors.
    My question over here is : is it the same MP for server running with FAT32 file system .

  11. Jason says:

    I have a scenario that my H drive was healthy and all of the sudden one day this drive was been removed for an hour and i dont see any alerts been raised on that.
    When i pull availability report for this, it shows that the H drive was down for an hour and when i look at the health explorer of this drive it has picked from not monitored to monitored.

    dont i get an alert if the healthy drive goes down without any errors on WMI ?

  12. Hari says:

    Even i have got the same problem, any solutions ?

  13. Almero says:

    Hi Guys , when they say Chkdsk , do they mean -F or the normal online one ?

  14. Mark Carroll says:

    Another great explanation, thanks Kevin !

Skip to main content