CHKDSK with Log file

[eric_d_green]

If I have placed this in the wrong group I apologize now.


I am running a network with 300+ Windows XP SP2 workstations. I need
to be able to run CHKDSK /r on all of the workstations and have a log
file copied to a network drive. That way I will know if any of the
workstations have hard drives going bad and I may be able to remedy the
problem before data is lost.


Tee original plan was to create a batch file to run on all of the
computers with the following:

chkdsk /r

But if you run this it requires you to type 'Y' and the enter to
schedule CHKDSK at the next startup.

To fix that I created a bat file to run on all of the computers with
the following:

ECHO Y | CHKDSK /r
shutdown -f -r -t 00

The bat file sets up CHKDSK to run at the next startup and then
immediately reboots the computer. CHKDSK runs and then the system
finishes booting.

At this point the log for the CHKDSK has been placed in the Event
Viewer under applications. And will look similar to this:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 3/2/2006
Time: 11:49:16 AM
User: N/A
Computer: XRDYEGREEN
Description:
Checking file system on C:
The type of the file system is NTFS.
Volume label is Operating System.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 1 unused index entries from index $SII of file 0x9.
Cleaning up 1 unused index entries from index $SDH of file 0x9.
Cleaning up 1 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

36571940 KB total disk space.
15511324 KB in 119974 files.
54160 KB in 7811 indexes.
0 KB in bad sectors.
406604 KB in use by the system.
65536 KB occupied by the log file.
20599852 KB available on disk.

4096 bytes in each allocation unit.
9142985 total allocation units on disk.
5149963 allocation units available on disk.

Internal Info:
08 25 05 00 34 f3 01 00 e4 00 03 00 00 00 00 00 .%..4...........
b2 04 00 00 01 00 00 00 6f 04 00 00 00 00 00 00 ........o.......
60 e8 00 07 00 00 00 00 d0 17 06 44 00 00 00 00 `..........D....
b8 40 dc 07 00 00 00 00 60 c3 d8 97 02 00 00 00 .@......`.......
58 71 9a 54 01 00 00 00 d4 de 1a 47 04 00 00 00 Xq.T.......G....
99 9e 36 00 00 00 00 00 90 38 07 00 a6 d4 01 00 ..6......8......
00 00 00 00 00 70 bc b2 03 00 00 00 83 1e 00 00 .....p..........

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


I need a way to get the CHKDSK log to a txt file that I can copy to a
network share. If i could either search the Event Viewer and find all
instances of Event ID 1001, Event Source Winlogon and copy those
entries into a text file OR be able to make a registry change or
command line change before rebooting for the CHKDSK so that it will
create its own log file. (Technically I have read in different places
that CHKDSK does create a log file but it is copied to the event viewer
and deleted as soon as the event log service starts up so if that log
file could be set not to delete that would work too.)

Any solution needs to be completed through a batch job or VB script as
I do not want to connect to 300+ computers to copy Event logs.

 

[Wesley Vogel]

Play with this.

ECHO Y | CHKDSK /r > C:\CHKDISKLOG.TXT
shutdown -f -r -t 00

Change C:\CHKDISKLOG.TXT to the location that you want.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[eric_d_green]

I had tried that previously. The problem is that will only copy the
following information since it does not actually run the CHKDSK until
reboot:

The type of the file system is NTFS.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N) y

This volume will be checked the next time the system restarts.

 

[eric_d_green]

Ok I have found a way to do this using PsLogList (freeware by
sysinternals) with the following command:

a second batch file will run the following:

psloglist app -i 1001 -o winlogon -s -t ; > c:\chkdsklogfile.txt
copy c:\chkdsklogfile.txt \\server\sharename\%computername%.chkdsk.log

This shows just event id 1001 source winlogon and puts it to a log file
and copies it to the network share I can then run a query to determine
if any issues exist.