Bad blocks Hard disk report.

[SEC_ALERTS]

Hi Team,

Is it possible to get the bad blocks hard disk report in Lansweeper?

Regards,
SEC_ALERTS

[wgknowles]

Can this report be modified to provide an aggregate # of bad blocks instead of a separate line for each bad block? I have some problem computers completely flooding the output.

[jasonh]

wgknowles wrote:
Can this report be modified to provide an aggregate # of bad blocks instead of a separate line for each bad block? I have some problem computers completely flooding the output.

I just threw this together. It shows everything that has had more than 5 "bad block" event logs in the last 2 days. You can obviously modify the count and number of days to your liking.

Select Top 1000000
  tsysOS.Image As icon,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.IPAddress,
  tsysOS.OSname,
(Select COUNT(tblNtlogMessage.MessageID)
FROM tblNtlogMessage
  Inner Join tblNtlog On tblNtlog.MessageID = tblNtlogMessage.MessageID
  Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
  Inner Join tblNtlogSource On tblNtlogSource.SourcenameID = tblNtlog.SourcenameID
WHERE tblNtlogMessage.Message Like '%bad block%'
And tblNtlogSource.Sourcename = 'disk'
And tblNtlog.AssetID = tblAssets.AssetID
And DateDiff(day, tblNtlog.TimeGenerated, GetDate()) < 2) as LogCount
From tblAssets
  Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Where (Select COUNT(tblNtlogMessage.MessageID)
FROM tblNtlogMessage
  Inner Join tblNtlog On tblNtlog.MessageID = tblNtlogMessage.MessageID
  Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
  Inner Join tblNtlogSource On tblNtlogSource.SourcenameID = tblNtlog.SourcenameID
WHERE tblNtlogMessage.Message Like '%bad block%'
And tblNtlogSource.Sourcename = 'disk'
And tblNtlog.AssetID = tblAssets.AssetID
And DateDiff(day, tblNtlog.TimeGenerated, GetDate()) < 2) > 5

[SEC_ALERTS]

It Works...Thanks for your reply!!

[Hemoco · Accepted solution]

You can try the following event log report:

Select Top 1000000 tsysOS.Image As icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.IPAddress,
tsysOS.OSname,
tblAssets.SP,
tblNtlog.Eventcode,
Case tblNtlog.Eventtype When 1 Then 'Error' When 2 Then 'Warning'
When 3 Then 'Information' When 4 Then 'Success Audit'
When 5 Then 'Failure Audit' End As Eventtype,
tblNtlogFile.Logfile,
tblNtlogMessage.Message,
tblNtlogSource.Sourcename,
tblNtlogUser.Loguser,
tblNtlog.TimeGenerated
From tblAssets
Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Where tblNtlogSource.Sourcename = 'disk' and tblNtlogMessage.Message Like '%bad block%'
Order By tblNtlog.TimeGenerated Desc