We recently found that a server in our environment was experiencing disk corrupt issues but we were not being notified of the condition by Operations Manager. Digging into the Operating System management pack, there is a rule (NTFS – File System Corrupt) which finds event #41 in the system log. From the product knowledge, we see that either event ID 41 or event ID 55 indicate potential error conditions:

image

Based upon the expression found for the rule this would not catch the event #55 we are seeing.

image

As a workaround to resolve this we created a new rule which matched the condition we are looking for (event #55 from source of NTFS in the System log).

image

We configured the alerting level to medium priority, warning severity and suppressed duplicates based upon the logging computer. For highly critical systems we created an override to set it to high priority, critical severity.

Summary: Event #55 disk corruption checks do not appear to be caught in the current version of the Operating System management pack (6.0.6794.0). This functionality should be added either to the existing rule which matches event #41 or should have a new rule created to catch this condition as well.