Home > Management Packs, Operations Manager 2007 R2, Operations Manager 2012 > Event ID 258 and Operations Manager

Event ID 258 and Operations Manager

This topic came up several times on the Operations Manager technet forums last month.

This event ID is a result of running checkdsk on a logical drive on a windows machine. This process is normally harmless, unless something I/O intensive is going on like perhaps an Exchange Backup, which this process could interrupt. As noted in this KB article http://support.microsoft.com/kb/2581021  the resolution is listed as “Disable the Logical Disk Monitoring in the SCOM Base OS Management Pack to stop automatic Defrag Analysis.”  below I’ll detail how to do this. Also note, the monitor we will be disabling via override, is in each of the Base OS Management Pack, is actually configured out of the box to run only once a week, on Saturday at 3 am. The Name of this Monitor is ‘Logical Disk Fragmentation Level’ and is targeted at the a specific Operating Systems Logical Disk, example below is the Windows Server 2003 Logical Disk.

Monitor Properties Logical Disk Fragmentation Level Properties


So depending on your environment of what systems you are monitoring you could need to make up to 3 overrides, one for Windows 2003 Server, one for Windows Server 2008 and one for Windows 2012.

Open the Opsmgr Console and go to the Authoring tab. To see only what is important to see for this demonstration I scoped the view to only show the Windows Server 2003 Logical Disk object. Do this by selecting the scope, then click the check mark next to view all object, and type in the box Windows Server 2003 Logical Disk, and click the check mark next to that object then click OK. Expand out the Windows Server 2003 Logical Disk object and expand out the Performance object to see the monitors that are acting on this object.


01 Monitor Logical Disk Fragmentation Level

Select the Logical Disk Fragmentation Level monitor and right click on it, select Overrides then select Override the Monitor, then select For all Objects of class: Windows Server 2003 Logical Disk. It is assumed that Override Management Packs have already been created for the purposes of this demonstration.


02 overides overrides the monitor for all objects of class


this will bring up the override dialog for this monitor.

04 Logical Disk Fragmentation Level overrid properties

Check the Enabled check box, and in the Override Value drop down box select False, to disable this monitor for all objects of class windows server 2003 logical disk. Please note this will only effect this one class, the other logical disk classes like Windows Server 2008 will not be effected by this change.

Usually when I create an override, I like to add a description to the Override so I will know when it was made and by whom, this can be a very useful audit trail. Click the Edit button and add date and your initials and why the override was made, then click the Ok button.

03 Override description Dialog

In the Destination Management Pack I select the Windows Server 2003 Operating System – Overrides MP, which I manually created before beginning the process, then click the Ok button.


It is very important to note, if there are event ID 258’s occurring more frequently than once a week, say like every two hours, then someone has either made an override to the monitor to run much more frequently (not very likely) or there is another MP is causing this to occur. The only other Management Pack I’ve seen use this is the Logical Disk Extension Management Pack (the Original)

http://www.systemcentercentral.com/PackCatalog/PackCatalogDetails/tabid/145/IndexID/64216/Default.aspx or the newer Logical Disk Extension Management Pack – Updated to v located here


David Allen, a fellow MVP, has created a great community management pack with the Logical Disk Extension MP. It has some detailed reports about disk utilization that many organizations find very helpful. The side effect of running this management pack is its need to run checkdsk every few hours to collect information about the logical disks. That being said, because the data is collected by a data source the rules (all twenty one of them) have to be fired off at the same time or else cook down will be broken. So if you are going to make an override on this management pack make sure to make the override to all 21 rules.

  1. Jeremy
    September 30, 2013 at 9:06 am

    you mentioned in the last paragraph that ” So if you are going to make an override on this management pack make sure to make the override to all 21 rules.” What do you mean by that? Can the the 258 be stopped if you have this MP installed?

  2. September 30, 2013 at 9:19 am

    Yes this is a side effect of this management pack, however, you could create overrides to all 21 rules to a group of computers that you do not want chkdsk to run on. So it would be possible to run this mp and not get the error on a certain subset of machines.
    Hope this helps!

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: