Now we can add another Rule called "Send Email Alert". This rule will have a few filters to only allow events with warning or error severity. The Eventlogtype is System and the event sources which matter to us are dmio and dmboot. The filters should look like in this screenshot.
For additional reference, here is a list of possible dmboot und dmio events: Event ID 1: "dmboot: Volume %2 (no mountpoint) started in failed redundancy mode." Event ID 2: "dmboot: Volume %2 (%3) started in failed redundancy mode." Event ID 3: "dmboot: Failed to start volume %2 (%3)" Event ID 4: "dmboot: Failed to encapsulate selected disks" Event ID 5: "dmboot: Disk group %2 failed. All volumes in the disk group are not available." Event ID 6: "dmboot: Failed to auto-import disk group %2. All volumes in the disk group are not available." Event ID 7: "dmboot: Failed to restore all volume mount points. All volume mount points may not be available. %2"
Event ID: 1, "dmio: Device %2,%3: Received spurious close" Event ID: 2, "dmio: Failed to log the detach of the DRL volume %2" Event ID: 3, "dmio: DRL volume %2 is detached" Event ID: 4, "dmio: %2 error on %3 %4 of volume %5 offset %6 length %7" Event ID: 5, "dmio: %2 %3 detached from volume %4" Event ID: 6, "dmio: Overlapping mirror %2 %3 detached from volume %4" Event ID: 7, "dmio: Kernel log full: %2 %3 detached" Event ID: 8, "dmio: Kernel log update failed: %2 %3 detached" Event ID: 9, "dmio: detaching RAID-5 %2" Event ID: 10, "dmio: object %2 detached from RAID-5 %3 at column %4 offset %5" Event ID: 11, "dmio: RAID-5 %2 entering degraded mode operation" Event ID: 12, "dmio: Double failure condition detected on RAID-5 %2" Event ID: 13, "dmio: Failure in RAID-5 logging operation" Event ID: 14, "dmio: log object %2 detached from RAID-5 %3" Event ID: 15, "dmio: check_ilocks: stranded ilock on %2 start %3 len %4" Event ID: 16, "dmio: check_ilocks: overlapping ilocks: %2 for %3, %4 for %5" Event ID: 17, "dmio: Illegal vminor encountered" Event ID: 18, "dmio: %2 %3 block %4: Uncorrectable %5 error" Event ID: 19, "dmio: %2 %3 block %4:\r\n Uncorrectable %5 error on %6 %7 block %8" Event ID: 20, "dmio: Cannot open disk %2: kernel error %3" Event ID: 21, "dmio: Disk %2: Unexpected status on close: %3" Event ID: 22, "dmio: read error on object %2 of mirror %3 in volume %4 (start %5, length %6) corrected" Event ID: 23, "dmio: Reassigning bad block number %2 on disk %3" Event ID: 24, "dmio: Reassign bad block(s) on disk %2 succeeded" Event ID: 25, "dmio: Fail to reassign bad block(s) on disk %2: error 0x%3" Event ID: 26, "dmio: Found a bad block on disk %2 at block number %3" Event ID: 27, "dmio: Corrected a read error during RAID5 initialization on %2" Event ID: 28, "dmio: Failed to recover a read error during RAID5 initialization on %2: error %3" Event ID: 29, "dmio: %2 read error at block %3: status 0x%4" Event ID: 30, "dmio: %2 write error at block %3: status 0x%4" Event ID: 31, "dmio: %2 write error at block %3 due to disk removal" Event ID: 32, "dmio: %2 read error at block %3 due to disk removal" Event ID: 33, "dmio: %2 is disabled by PnP" Event ID: 34, "dmio: %2 is re-online by PnP" Event ID: 35, "dmio: Disk %2 block %3 (mountpoint %4): Uncorrectable read error" Event ID: 36, "dmio: %2 %3 block %4 (mountpoint %5): Uncorrectable read error" Event ID: 37, "dmio: Disk %2 block %3 (mountpoint %4): Uncorrectable write error" Event ID: 38, "dmio: %2 %3 block %4 (mountpoint %5): Uncorrectable write error"
The next step is to create a SendEmail Action and configure it like in the screenshot.
Here is the Event message we suggest to use, but feel free to create and modify your own:
You need to replace the mail server, sender and recipient with yourself. |