Scanner False-Positives Causing Numerous Alerts

[Quinn]

I have a weird issue involving Scanner and S.M.A.R.T. monitoring that has happened in the past numerous times; I've just never caught it in time to troubleshoot...

 

After a reboot of my server running StableBit, I am getting many alerts regarding the load cycle count...funny thing is, Scanner keeps telling me that it is reporting 2,336,668 load cycles on a single drive.  After a few minutes, it will report that EXACT SAME count on a different drive...again and again.  I have received 73 email alerts in the last 3+ hours, involving all of my 9 drives.  It seems like it picks one at random every few minutes...

 

OS: Windows 10 64-bit Version 1511 (Build 10586.218)

Scanner: 2.5.2.3103 BETA

 

I'm pretty sure I don't ACTUALLY have 2,336,668 load cycles on ANY drive...I have had this happen in the past, but I can't think of anything that causes it.  It's not on every reboot, and it's been with different versions of Scanner...any ideas on how to troubleshoot this?

Thank you ahead of time,

 

Quinn

 

Follow-up - I also noticed that I have multiple drives reporting a power-on time of 5 years, 62 days...I always buy drives one at a time, so I'm not sure why S.M.A.R.T. would be reporting this on multiple (but not all) drives at the same time...

[Christopher (Drashna)]

Of course, it stopped sending the alerts, making it more difficult to troubleshoot now

 

Yes, it showed the same incorrect information in the UI.  Last night I sat and watched it for ~15 minutes, and different drives flipped from "healthy" to "error" (or whatever it said...it was late...) and back again at random, every few minutes.  As of right now, they are all listed as "healthy"...

 

Do you still want me to check the "NoWMI" option?

 

Naturally. That's the way it goes sometimes.

 

And if you're seeing it switch like that, then yes, definitely enable the NoWmi option, as that is likely why you're seeing this. 

 

Just don't forget that you'll need to restart the service, or reboot the system to get it to apply the setting.

[Christopher (Drashna)]

Do any of the drives report this incorrect information in the UI?

If not, then this may be related to a WMI issue.  In that case, disabling the WMI query method may fix the issue that you're seeing.

To do so:

Click on the Settings button in the toolbar and select Scanner Settings. Enable the Show advanced settings and information option, and hit "OK". You will only need to do this once, from now on, it will always display this option.

Click on Settings, and select the new Advanced Settings and information option. Open the Configuration Properties tab. You will find a list of all the settings here, organized into sections. Find the "Scanner" section, check the "NoWmi" option and reboot the system. 

 

THis may fix the issue. 

 

If not, let us know.

[Quinn]

Of course, it stopped sending the alerts, making it more difficult to troubleshoot now

 

Yes, it showed the same incorrect information in the UI.  Last night I sat and watched it for ~15 minutes, and different drives flipped from "healthy" to "error" (or whatever it said...it was late...) and back again at random, every few minutes.  As of right now, they are all listed as "healthy"...

 

Do you still want me to check the "NoWMI" option?

[Quinn]

I made the change to Scanner and restarted the service.  Unfortunately, I'm not sure how to reproduce the event, so IF it doesn't fix the issue, I may not see it happen again for months...I'll keep an eye on it

 

Thank you for your quick and concise help, it is always appreciated!

 

Would you be able to go a little in depth on why you think it's a WMI issue?  #LearningOpportunity

 

Thanks again!

[Christopher (Drashna)]

Well, if you have notifications enabled, you *should* get one when it flags something in the future.

 

 

As for why, this a bit more complicated. 

Specifically, we use two methods for querying for SMART data. The default is "WMI", which is used extensively in Windows. Heck, most of the data that StableBit Scanner uses is from WMI.  Any of the "system spec" tools you may use are pulling info from WMI. 

And you can use "wmic" to access a lot of that data (or use GUI versions of it). 

 

The other method we use, we call "Direct IO", and this is querying the driver directly rather than going through WMI.  This is more direct, but some methods have issues (that's why we have the "Unsafe Direct I/O" option, as we blacklist the known problematic methods. 

 

 

 

The issue is that in rare cases, some controller/drive combinations can cause the WMI data to be incorrect. And usually, when this happens, it' changes values back and forth. If you check, there are a number of threads where people mention that they get error notifications but when they check, there is no error.    That's cause because the data in WMI is changing periodically, causing the issue. 

 

Unfortunately, it's not as simple as just "knowing" which is correct. It may be a legitimate change.