Event Logging for RAID fault in 2008 R2
Solution 1:
This is indeed quite surprising, leave it Microsoft to make a feature worse. In some ways this is not a surprise.
I believe that you can "monitor" the status of the RAID using the diskpart utility. For some example commands see http://www.techotopia.com/index.php/Creating_and_Managing_Windows_Server_2008_Mirrored_%28RAID_1%29_Volumes.
I don't have a 2008 software raid myself unfortunately, but I can only imagine that the output of list volume will indicate when a drive is offline or in a faulty state. An example output of list volume looks like this
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 E DATA NTFS Simple 931 GB Healthy
Volume 1 D DVD-ROM 0 B No Media
Volume 2 System Rese NTFS Partition 100 MB Healthy System
Volume 3 C BOOT NTFS Partition 138 GB Healthy Boot
Volume 4 F FreeAgent G NTFS Partition 1863 GB Healthy
You simply create an text file with the content being
list volume
and then run it like
diskpart /s file.txt
You could then pipe the output to a file and parse it with a script, and generate an email or event log entry. You would need to run this script every X minutes, e.g. with the task scheduler.
You could use EventSentry (free version available) and its application scheduler to execute this script, and generate an event/email, but you would still have parse the output from diskpart to determine whether there is a problem or not.
Edit: The status of a failed RAID in Windows is "Failed Rd" opposed to "Healthy". As such, searching for "Failed Rd" should work. Example:
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 C BOOT NTFS Mirror 931 GB Failed Rd Boot
I'll do some experimenting with this in the future to come up with a better answer and write a blog entry, I had no idea that Microsoft dropped the ball on this.
Solution 2:
Here's a simple batch script that will log an event on failure to system:
echo list volume | diskpart > c:\RAID_STATUS.TXT
FINDSTR "Failed" C:\RAID_STATUS.TXT
IF ERRORLEVEL 1 GOTO OK
GOTO FAILED
:FAILED
SETLOCAL ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION
FINDSTR "Failed" C:\RAID_STATUS.TXT > C:\FAILED_RAID.TXT
set eventtext=
for /f "delims=" %%l in (C:\FAILED_RAID.TXT) do set eventtext=!eventtext! %%l
eventcreate /ID 999 /L SYSTEM /T ERROR /SO SW_RAID /D "%eventtext%"
GOTO OK
:OK