Glen Munro Network Admin: Hard drive

Showing posts with label Hard drive. Show all posts

Monday, February 2, 2015

SCCM 2012 Hard Drive with Bad Blocks Baseline

This PowerShell script will detect systems where the main hard drive is developing bad blocks.
Or as I call it, the "Click of Death".

Continuing with my previous posts on SCCM 2012 baselines items...
http://gmnetadmin.blogspot.ca/2015/01/using-sccm-2012-compliance-settings-to.html

Same steps as Option 2 in the above mentioned post but using the discovery script below...
Changes...

You can add more If statements or expand it use ElseIf to record bad blocks from other hard drives.
Or change the text in the If statement to just '*bad block*' to count all bad blocks event entries.

#Version 1.00 Feb 2, 2015
#SCCM Baseline for Bad Block on C Drive
$AllEvents = 0

#Default Event Logs
$Provider = "Disk"
$HourChange = 24
$TimeNow = [DateTime]::Now
$TimeChange = [DateTime]::Now.AddHours(-$HourChange)

#Check Event Log for errors
$EventLogNames = "System"

ForEach ($log in $EventLogNames){
$entry = " "
#Search Event Logs

$LogEntry = Get-WinEvent -LogName $log | Where-Object {$_.timeCreated -ge $TimeChange -and $_.ProviderName -eq $Provider}
ForEach ($entry in $LogEntry){
$EvLevel = "Level: `t" + $entry.LevelDisplayName + $nl
$EvEventID = "EventID: `t" + $entry.ID + $nl
$EvMessage = "Message: `t" + $entry.Message
$EvSource = "Source: `t" + $entry.ProviderName + $nl
$EvTime = "Time Created: `t" + $entry.TimeCreated + $nl
#write-host $EvLevel + $EvEventID + $EvMessage + $EvSource +$EvTime + $nl

If ($EvMessage -like '*The device, \Device\Harddisk0\DR0, has a bad block*'){
$AllEvents += 1
}

}

}
write-host $AllEvents

More SCCM related posts

Thursday, January 29, 2015

SCCM 2012 Task Sequence for Failing Hard Drive

Now that you have collections created based S.M.A.R.T diagnostics or Disk event log entries baselines for failing hard drives... (See previous post)

We can create a custom Task Sequence to notify the user of the problem, when they log onto the computer.

Optionally, you could also deploy this as an available task sequence, for end users to manually check hard drive status.

Here are my suggestions for the task sequence...

Name: Hard Drive Diagnostic
Progress notification text: "Please submit a help desk ticket if the hard drive reports as failing." (or use the standard "Running: <Task sequence name>")
Suppress task sequence notifications - Optional
Maximum run time: 5 minutes
Run on any platform.

Sequence of Tasks... (Keep in mind that the "Name" is what the end user will see on the screen)

Set Task Sequence Variable

Name: Testing hard drive health. Please wait.
Variable: HD Failure
Value: True
Options:Add a WMI query Condition

WMI Namespace: root\wmi
WQL Query: select * from MSStorageDriver_FailurePredictStatus Where PredictFailure = True

Group 1:

Name: Hard Drive Diagnostic Finished
Options: Add a Task Sequence Variable

Variable: HD Failure
Condition: Equals
Value: True

Run Command Line (Under Group 1)

Name: The hard drive is failing
Command line: ping 127.0.0.1 -n 30

Should last about 30 seconds on the screen

Run Command Line (Under Group 1)

Name: We recommend replacing the hard drive.
Command line: ping 127.0.0.1 -n 30

Should last about 30 seconds on the screen

Group 2:

Name: Hard drive Diagnostics Finished
Options: Add a Task Sequence Variable

Variable: HD Failure
Condition: Not Exists

Run Command Line (Under Group 1)

Name: Hard drive passed diagnostics
Command line: ping 127.0.0.1 -n 10

Should last about 10 seconds on the screen.

Using SCCM 2012 Compliance Settings to Determine Hard Drive Health

As long as your computer has S.M.A.R.T hard drive diagnostic capabilities, the following can be used to track hard drive failures.

Configuration Item(s) in SCCM 2012.

Option 1 - Using WQL query

Name - Hard Drive Predictive Failure

Platforms - All (Although, if they are virtual machines this will not work.)

Settings -

Name: Storage Driver Failure Prediction
Type: WQL Query
Data: String
Namespace: root\wmi
Class: MSStorageDriver_FailurePredictStatus
Property:PredictFailure

Compliance Rules

Name: Possible Hard Drive Failure is True

I named it this to remind me that "False" is the result we want.

Rule: Storage Driver Failure Prediction Equals False
Noncompliance severity: Critical

Option 2 - Using PowerShell script to read system event log

This option will read the System event log and count any 'disk' source logs that are not Information level.
Note: This will include issues with temporarily attached external hard drives or USB drives.

Name - Event Log Disk Errors
Platforms - All (This will work for servers and virtual machines)
Settings

Name: Report disk errors found in Event Log
Type: Script
Discovery script (See end of post)

Counts the events and writes that value.

Compliance Rules

Name: Disk error count
Rule: Less than 1 (That's a number one)
Noncompliance severity: Critical

Now that you have created the Configuration Items, you can add (one or both) to a Configuration Baseline and deploy them to your collections.

Once deployed create collections for the non compliant systems and then use that information in reports for your help desk or create a Task sequence that alerts the end user that the hard drive is may be failing.

Here's the PowerShell script...
- Updated Feb 3, 2015 to exclude '*Device\Harddisk1\DR1*' event logs.

#Version 2.30 Feb 3, 2015
#Designed for SCCM Baseline
$AllEvents = 0
#Default Event Logs
$Provider = "disk"
$HourChange = 24 #Up to you how far back you want to go
$TimeNow = [DateTime]::Now
$TimeChange = [DateTime]::Now.AddHours(-$HourChange)
#Check Event Log for errors
$EventLogNames = "System"
ForEach ($log in $EventLogNames){
    $entry = " "
    #Search Event Logs

    $LogEntry = Get-WinEvent -LogName $log | Where-Object {$_.timeCreated -ge $TimeChange -and $_.ProviderName -contains $Provider -and ($_.LevelDisplayName -eq 'Warning' -or $_.LevelDisplayName -eq 'Error' -or $_.LevelDisplayName -eq 'Critical')}
        ForEach ($entry in $LogEntry){
            $EvLevel = "Level: `t" + $entry.LevelDisplayName + $nl
            $EvEventID = "EventID: `t" + $entry.ID + $nl
            $EvMessage = "Message: `t" + $entry.Message + $nl
            $EvSource = "Source: `t" + $entry.ProviderName + $nl
            $EvTime = "Time Created: `t" + $entry.TimeCreated + $nl
            #write-host $EvLevel + $EvEventID + $EvMessage + $EvSource +$EvTime + $nl

#If ($entry.LevelDisplayName -eq "Critical" -or $entry.LevelDisplayName -eq "Warning" -or $entry.LevelDisplayName -eq "Error"){
If ($EvMessage.tostring() -like '*Device\Harddisk1\DR1*'){
#nothing
}
ElseIf ($entry.LevelDisplayName -eq "Critical" -or $entry.LevelDisplayName -eq "Warning" -or $entry.LevelDisplayName -eq "Error"){
$AllEvents += 1
}

        }
}
write-host $AllEvents

More SCCM related posts