Windows Monitor - Check Disk Errors Script

Problem Overview

Unexpected disk errors can lead to data corruption, system performance degradation, and potential downtime if they go unnoticed. Manually sifting through event logs is time-consuming, and missing a single critical warning can escalate into a widespread issue for IT Professionals and MSPs managing multiple endpoints.

Description

This PowerShell script checks the Windows System event log for common disk-related error codes. If any matching events are detected, it returns an “ALERT” message, making it easier to spot issues in real time. When no problematic events are found, it responds that disks are healthy.

You can run this script on demand by configuring a script-based monitor in Level, ensuring you’re immediately alerted whenever disk errors appear. Alternatively, you can set up a scheduled automation in Level to regularly scan event logs, helping you catch early signs of drive failures or file system inconsistencies before they impact your operations.

Script

1<#
2This resource is provided as a convenience for Level users. We cannot 
3guarantee it will work in all environments. Please test before deploying 
4to your production environment. We welcome contributions to our community 
5library
6
7Level Library
8https://level.io/library/script-windows-monitor-check-disk-errors
9#>
10
11$ErrorActionPreference = 'silentlycontinue'
12$TimeSpan = (Get-Date) - (New-TimeSpan -Day 1)
13if (Get-WinEvent -FilterHashtable @{LogName = 'system'; ID = '11', '9', '15', '52', '129', '7', '98'; Level = 2, 3; ProviderName = '*disk*', '*storsvc*', '*ntfs*'; StartTime = $TimeSpan } -MaxEvents 10 | Where-Object -Property Message -Match Volume*) {
14    Write-Output "ALERT"
15    Exit 1
16}
17else {
18    Write-Output "Disks are Healthy"
19    Exit 0
20}

Use Cases

• Monitoring production servers for disk or filesystem errors
• Automating proactive checks on workstation fleets
• Catching early signs of failing hard drives or storage drivers
• Preventing unplanned downtime by responding quickly to disk alerts

Recommendations

• Test the script on a single system or small environment before wide deployment
• Use a script-based monitor in Level for real-time alerts when errors appear
• Configure a schedule in Level’s Automations to run regular checks
• Investigate any “ALERT” outputs immediately to address potential disk failures
• Keep system event logs intact for accurate error tracking

FAQ

• How do I run this script?
  ‍Simply import it into Level, then add it to a script-based monitor or an Automation workflow.

• Which event IDs does the script check?
  ‍It looks for critical disk-related events (IDs 11, 9, 15, 52, 129, 7, 98) in the System log.

• Will it fix the disk errors automatically?
  ‍No, the script only detects potential issues. Pair it with a remediation plan or automation to handle errors.

• What if multiple disks are connected to the system?
  ‍The script checks all relevant events in the Windows System log, covering all disk devices on the machine.

• How often should I run it?
  ‍Frequency depends on your environment. Critical servers may benefit from hourly checks, while less critical systems might be fine with daily scans.