Monitor and/or Alert When A Volume Disappears

Greetings. I am hope someone here can point me in the right direction.

We have had some issues with servers rebooting and all of the drives do not come back from the reboot.

Solarwinds Orion will report that a Volume Disappeared and a Volume Reappeared on the node page. How can I figured out what these are so I can monitor for them?

We had an issue pop up yesterday that if we knew the volume disappeared it would have saved a huge amount of time.

Screen shot below. Thanks!

Find more posts tagged with

volume

hard drive

Accepted answers

All comments

jm_sysadmin

It's an event, but "volume disappeared" might be what Orion shows it as, not what it logs. Its certainly not an event that pops up when you look at events from the alert.

I think that data lives in the Auditing Events I would bet that 'Volume disappeared' is really deleted by system. I could be wrong.

One of the reasons it's hard to track down is that it's just an event, and it's not tied to another object like a nodeID or volumeID.
So I didn't want to do a custom SWQL alert, so I gave it a shot in the alert page with a event creating an Auditing event, and message starts with 'User SYSTEM deleted volume'. I can't test this easily, so I hope that works.

sum_giais

Perhaps helpful - the disappeared and reappeared events seem to corelate to the responding property on volumes perhaps. That would make it a super easy alert. Double check with this query if you like:

SELECT
     v.Node.Caption AS [Node]
    ,v.Caption AS [Volume]
    ,v.Responding
FROM Orion.Volumes AS v

martian_monster

Thank you for explaining all of this!!