UIM - Monitor disk offline state / NTFS mount dismounted

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

We need to monitor disk offline status for Windows servers but this option is not available in the CDM probe.

We are trying to get an alert whenever a non-OS disk on a Windows server goes offline:

How can we monitor when an NTFS volume is successfully dismounted?

Environment

• Release: UIM 20.4
• CDM, ntevl, any version

Cause

• Guidance

Resolution

• When changing the disk status from offline to online the event is written in the Windows Event log.
• Event ID 303 is generated in the Windows Event Log when the NTFS volume has successfully dismounted.
• Technically this event indicates: "This event is logged when the user on client computer disconnected from the following network resource"
• Using the ntevl probe it is possible to monitor this event and receive an alarm when this event occurs
• NT Event Log (broadcom.com)