Hi, I could see event id:258 in Application event log every 2 hrs on my servers. Are these events are triggered by SCOM. I think it is NOT. Please correct me if I am wrong. I dont want to have these events triggered in eventvwr. On checking Schedule Tasks, I dont find any task related to Defrag. In SCOM, below is the monitor status "Logical Disk Fragmentation Level" monitor is enabled but the Discovery Task is NOT set to run. Please help me out on stopping Event Id: 258 on my servers. Log Name: Application Source: Microsoft-Windows-Defrag Date: <date> <time> Event ID: 258 Task Category: None Level: Information Keywords: Classic User: N/A Computer: <hostname> Description: The disk defragmenter successfully completed analysis on (C:)Regards, Suresh

Hi, By default these events are not triggered by OpsMgrPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks for you reply!!! In one of your thread (http://social.technet.microsoft.com/Forums/en-US/operationsmanagergeneral/thread/53b508ff-6684-4e54-a3e0-36090d2dc084), I found that we need to disable "Logical Disk Fragmentation Level" monitor. May I know in what case this monitor need to be disabled? Is it just to stop alerts? Bcoz Microsoft mentioned (http://support.microsoft.com/kb/2581021) that disabling the monitor will "stop automatic Defrag Analysis". I am not clear in this part. Also interested to know how these 258 events are being triggered.Regards, Suresh

Can anyone suggest why I am seeing these 258 events in Application log???Regards, Suresh

I also see them even after disabling the "Logical Disk Fragmentation Level" monitor, please suggest if its from Server Base OS MP or not!

You should Disable the Logical Disk Monitoring in the SCOM Base OS Management Pack to stop automatic Defrag Analysis. For detail pls refer http://support.microsoft.com/kb/2581021 Roger

What specific Logical disk Monitor need to be disabled? Thanks

did you create an override to disable the logical disk monitor? did you verify that the override made it to the host that is still getting the event log messages? if so I'd restart the opsmgr agent to make sure its getting updated info from the managment server. I ran into the same problem once b/c we were also using the logical disk extension mp which runs a smilar script as the base os mp. by chance are you running that MP too? if so you will need to remove the logical disk extenstion mp. Hope this helps! Scott Moss MVP (Operations Manager) President - System Center Virtual Users Group |Vice President - Atlanta Southeast Management Users Group (ATL SMUG) Please remember to click Mark as Answer on the post that helps you! my new blog om2012.wordpress.com

Hi Scott, Thank you for the response. What logical disk need to disable? is it both Under availability rollup and Performance rollup? I've already override to disable Logical Disk Fragmentation to C, D and E drives but still getting event ID 258. Do i need to disable "Average Disk Seconds Per Transfer" monitor too? Or need the performance hardware rollup be disabled? Have any idea on this?

In the official support article it states that you have to disable the entire logical disk monitoring... http://support.microsoft.com/kb/2581021 Did you create the override on the monitor for ALL logical disks or only on specific objects? Just to make sure: The override place: Just to check whether your override is working can you limit the override to 1 day of the week? In the day of week mask change it to 2 for example to force it to run only on a monday and see whether the alerts are also generated on the other days... If that's the case the override is not working and we have to investigate further. It's doing common things uncommonly well that brings succes.

Actually it runs every day and in every 3 hours. but i'll try to simulate above. What monitor or rule uses below task? How to disable this task. Thank you,

Actually it should run only once a day by default at 3:00 am. But check out whether the overrides work when you limit the execution to 1 single day and get back to me to troubleshoot further.It's doing common things uncommonly well that brings succes.

I have disabled The logical Disk Fragmentation Level but still generates Event 258. And tried to overrides the monitor as you've advised still get the events.

What OS is this? reason I'm asking is did you make the override for the correct OS? There is a different monitor for each OS, so if you made the override to disable it on the windows 2003 monitor, and this is a windows 2008 box, the monitor will still be running on that box. To make sure you have this right, open up Management Pack Objects, and select Monitors, change the scope type in Logical and select show all object, and select the Windows Server 2003 logical disk, Windows Server 2008 Logical Disk, and Windows Server 2012 Logical Disks. Expand out under performance under the OS that this machine is running, and right click on Logical Disk Fragmentation Level monitor, and right click Select Overrides > Override the Monitor > For all objects of Class: Windows Server 20xx Logical Disk. Click the Override box next to Enabled, and change the Override value to False. then save to an Override MP for the name of the OS that you are working with. do not save it to the default management pack. then click ok. By default this rule should only run once a week at 3 am. so unless the monitor already has an override, it should not be running more than once a week. Hope this helps.Scott Moss MVP (Operations Manager) President - System Center Virtual Users Group |Vice President - Atlanta Southeast Management Users Group (ATL SMUG) Please remember to click Mark as Answer on the post that helps you! my new blog om2012.wordpress.com

Windows Logical Drives Management Pack? This is not from the BASE OS MP. This is an add on MP. I ran into the same problem once b/c we were also using the Windows logical disk extension mp which runs a similar script as the base os mp. The easiest way to fix your problem is by removing the Windows Logical Drives MP. I don't know which version of the MP your running so it would be easier to remove this mp than create overrides. Once the Windows Logical Drives Mp has been removed check the step by step below to make sure the once a week defrag check has been disabled for the os on the client machine. Scott Moss MVP (Operations Manager) President - System Center Virtual Users Group |Vice President - Atlanta Southeast Management Users Group (ATL SMUG) Please remember to click Mark as Answer on the post that helps you! my new blog om2012.wordpress.com