MP ISA 2006 : Log Drive Free Space Monitor BUG

Yesterday a colleague of mine emailed me for help as he is experiencing issues with an ISA 2006 Management Pack (version 6.0.6648.0) Monitor. The monitor identifies a problem on Disk E: of an ISA 2006 Server.


My colleague checked the Knowledge base on the alert to identify possible causes, but he was unable to understand why the monitor indicates a problem on a disk with more than 50GB of free space.


I started looking inside the MP to verify this strange behavior.

The monitor name is Microsoft.ISAServer.2006.Logging.ServerRole.LogDriveFreeSpaceMonitor and is based on the Monitor Type Microsoft.ISAServer.2006.LogDriveFreeSpaceMonitor with a data source named Microsoft.ISAServer.2006.Monitor.LogDriveFreeSpace.DataSource. The data source uses a script called ISA2006LogDriveFreeSpaceMonitor.vbs that returns  :

  • Status = 1 : Healthy
  • Status = 2 : Warning
  • Status = 0 : Error

I started debugging the script directly on the ISA Box setting a breakpoint in the line where the script detects the error status on disk : image

As it can be seen in the previous picture the debugger breaks at the line strMonitorStatus = “0” (highlighted in yellow). This line of code is reached only if the variable strDiskStatus is not equal to “OK” or if the variable strMonitorStatus is not equal to “1”. Using the “Command Windows” provided by the debugger I dumped the value of the variables strDiskName, strMonitorStatus and strDiskStatus :

strDiskName = E:
strDiskStatus = “” 

strMonitorStatus = “1”

So the problem seems to be that for disk E: an empty status is returned.

strDiskStatus is retrieved using the function GetDiskProperty :

strDiskStatus = GetDiskProperty(objDrStCol, intDsk, "Status")

The function GetDiskProperty uses the collection objDrStCol and reads the property “status” for the element at the index equal to intDsk (in this case at IntDsk = 2 as can be seen in the command Window in the previous picture).

Function GetDiskProperty(objCollToUse, intToRead, strPropToRead)
Dim objElem
Dim intElem, strPropValue
intElem = 1
For Each objElem In objCollToUse
    If intElem = intToRead Then
       strPropValue = objElem.Properties_(strPropToRead).Value
    End If
    intElem = intElem + 1
GetDiskProperty = strPropValue
End Function

The collection objDrStCol is returned by a Wmi query strWMIQuery1  :

strWMIQuery1 = "Select * From Win32_DiskDrive"

using the function GetWMICollection

Set objDrStCol = GetWMICollection(TargetComputer, strNamespaceToUse, strWMIQuery1).

Here I found the problem, on this machine the Wmi query returns only an element (onjDrStCol.Count = 1) that is the only physical disk present and containing 2 partitions. The function GetDiskPropery assumes that Disk E: is located on a second physical disk, since E: is a partition on the first disk the function does not return a valid status.

This seems to be a BUG in this script that could be fixed in two different ways :

1) It is possible to replace the query "Select * From Win32_DiskDrive" with the query "Select * From Win32_LogicalDisk”. The Class Win32_LogicalDisk has a Property status that seems identical to the property present in the Win32_DiskDrive Class. With the class Win32_LogicalDisk it is possible to insert a where clause using the drive letter instead of using the index to match the correct drive.

2) It is possible to use couple of association classes (Win32_DiskDriveToDiskPartition and Win32_LogicalDiskToPartition) as explained in the following blog post : to retrieve the physical disk associated to the Logical disk, and then access to the status property of the right physical disk.

Since I’m not sure if the status returned by the Win32_LogicalDisk class is equal to the status returned by the Win32_DiskDrive class, I used the second way to rewrite the Script used by this monitor.

I created a Function GetDiskPropertyEx that uses Win32_DiskDriveToDiskPartition and Win32_LogicalDiskToPartition to find the corresponding Physical Disk of the specified logical drive and returns the property passed as the last parameter.

Function GetDiskPropertyEx(TargetComputerToUse,strNamespace,strLogicalDisk, strPropToRead)
Dim strPropValue
Dim colPartitions
Dim objPartition
Dim objDrive
Dim colDiskDrives

Set colPartitions = GetWMICollection(TargetComputerToUse,strNamespace,"ASSOCIATORS OF {Win32_LogicalDisk.DeviceID=""" &  strLogicalDisk & """} WHERE AssocClass = ""Win32_LogicalDiskToPartition")
For Each objPartition in colPartitions
    Set colDiskDrives = GetWMICollection(TargetComputerToUse,strNamespace,"ASSOCIATORS OF {Win32_DiskPartition.DeviceID=""" &  objPartition.DeviceID & """} WHERE AssocClass = ""Win32_DiskDriveToDiskPartition")
    For Each objDrive In colDiskDrives
        strPropValue = objDrive.Properties_(strPropToRead).value

GetDiskPropertyEx = strPropValue
End Function

then I replaced in the script the call to the function GetDiskProperty to get the status of the disk :

strDiskStatus = GetDiskProperty(objDrStCol, intDsk, "Status")

with the function GetDiskPropertyEx :

strDiskStatus = GetDiskPropertyEx(TargetComputer, strNamespaceToUse,strDiskName, "Status").

Since I don’t like hardcoded threshold I made the percentage and the MB threshold overrideable, and I fixed a “variable is not defined” that occurs if an override enables “Log Success Event” parameter.

I created a new MP with the modified script and monitor and I included an override that disables the original monitor. The MP is available at the following link “microsoft.isaserver.2006.fix.xml”, remove the .doc extension used only to upload the file since xml file are not allowed.

– Fabrizio

This posting is provided “AS IS” with no warranties, and confers no rights.


, ,

  1. #1 by Fabrizio Guaitolini on October 25, 2011 - 8:03 am

    Hello Morten, sent by E-Mail.


  2. #2 by Morten on October 24, 2011 - 12:10 pm

    Hello, I have been reding your post on ISA 2006 MP with great interest.
    However, I get an HTTP406 error from the web server when trying to download the xml document attached to the post. Would it be possible for you to send it to my email (myeas (a)

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: