Help Interpreting Event Log, Please

I run ChkDsk regularly ( "ChkDsk C: /f," "ChkDsk J: /f," and then respond "Y" to have Windows do it at next system start); when I look at the Event Log, I've noticed that C's result is different from H, I, J's results in that C's result does not have the line, "Windows has checked the file system and found no problems," while H, I, & J's do. I'm wondering what this means.

Here are the relevant parts of the Event Log.

Checking file system on J:
The type of the file system is NTFS.
Volume label is All Music.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up 1 unused index entries from index $SII of file 0x9.
Cleaning up 1 unused index entries from index $SDH of file 0x9.
Cleaning up 1 unused security descriptors.

A disk check has been scheduled.
Windows will now check the disk.
Windows has checked the file system and found no problems.

140536619 KB total disk space.
12932256 KB in 3404 files.
1548 KB in 302 indexes.
0 KB in bad sectors.
73983 KB in use by the system.
65536 KB occupied by the log file.
127528832 KB available on disk.

4096 bytes in each allocation unit.
35134154 total allocation units on disk.
31882208 allocation units available on disk.

Checking file system on C:
The type of the file system is NTFS.
Cleaning up minor inconsistencies on the drive.
Cleaning up 9 unused index entries from index $SII of file 0x9.
Cleaning up 9 unused index entries from index $SDH of file 0x9.
Cleaning up 9 unused security descriptors.

79875148 KB total disk space.
11175572 KB in 48527 files.
16184 KB in 2998 indexes.
0 KB in bad sectors.
123676 KB in use by the system.
65536 KB occupied by the log file.
68559716 KB available on disk.

4096 bytes in each allocation unit.
19968787 total allocation units on disk.
17139929 allocation units available on disk.

Windows has finished checking your disk.
Please wait while your computer restarts.

On my system, C (system), H, I, & J are partitions of the 320 GB hard drive. (H & I's logs are identical with J's.) I'm running XPpro SP2. CPU is an Athlon 64 x 2 5200+ (dual-core, runs at 2.6 GHz), MBoard is an MSI 7253 (compatible with CPU), RAM is 1 GB DIMM. I'm asking not because I'm worried but because I'd like to know. Are the "minor inconsistencies" found on C but not on J considered by Windows to be "problems" that J doesn't have? Why are the "unused index entries" on all partitions identical? Please reduce my ignorance.

D_Spider

 

Thanks Tony, good link with lots of info about CHKDSK.

BTW,the URL for XP is http://support.microsoft.com/kb/314835/EN-US/

Pete.

 

Thanks for the links. I read, but they don't answer my question; they tell what chkdsk does, which chkdsk (normal or autocheck) runs under which circumstances, but they say nothing about interpreting the results.

Tony, I run chkdsk at system startup, when nothing (as far as I know) is in use. I have to run it then for the C (system) partition. The way I do it is to get a command-line prompt, and enter the command & parameter. Windows responds with the "... in use ... want to run it at next reboot? ..." response, to which I respond "Y" and then "exit. "

----------
This brings up another question. If I run chkdsk on the non-system partitions (from the command line), I get a response asking me if I want to "force a dismount" on that partition. What does that mean? I just answer "N," which brings up the "want to run it at next reboot?" question, to which I answer "Y." What does "force a dismount" mean?
----------

Back to my initial question... I am running chkdsk when nothing on any of the partitions is in use by me, but there's still that difference in the results.

D_Spider

 

D Spider,

You are getting the different terminology in the reports that you are comparing because you are actually running two different disk checking programs.

When you are in the Windows environment, the chkdsk request for a check of any drive that is not the current boot drive will run the chkdsk.exe tool, which is a 12KB sized application.

If however, you request a check of the current boot drive and answer yes to allow it to occur upon reboot, the program that will run will be autochk.exe tool, which is a 575 KB sized application.

I can't tell you why MS allowed the confirmation message to be different on each program. Let's just use their standard response, "It's by design."

If I have missed your point and you're saying that your non-boot drives require you to run the disk check upon reboot and you are getting the different message than what is rendered when the boot drive is checked, then I'd have to invoke the MS line again, "It's by design. "

I have no way of verifying your results since my non boot drives apparently aren't running anything that causes them to need dismounting for a disk check. I just use mine for data storage - there are no programs installed on them that might cause what you are experiencing.

 

Thank you both!

My curiosity is satisfied, and I even learned something(s).

I dismounted I: and ran chkdsk just now, and the screen showed this:

C:WINDOWS\system32>chkdsk i: /f
The type of the file system is NTFS.
[vol in use...force a dismount? Y vol dismounted... info]
Volume label is Setup Files.

[verifying files...indexes...sec.descriptors info]

5116702 KB total disk space.
717860 KB in 1153 files.
548 KB in 180 indexes.
0 KB in bad sectors.
29578 KB in use by the system.
27632 KB occupied by the log file.
4296180 KB available on disk.

4096 bytes in each allocation unit.
1279175 total allocation units on disk.
1092190 allocation units available on disk.

which is briefer than what the logon event log shows, but, as you say, a different program was checking the disk. Had I known enough to dismount the non-system partitions, I would have gotten three of these reports, and since they wouldn't contain "and found no problems," I wouldn't have noticed the difference between them and the C-partition's report.

But I'm glad I know, now.

D_Spider

 

I will add that running an error check on a drive and asking it to automatically "Fix" any errors it finds has an element of risk and I recommend performing a full backup prior to doing it.

 

If I asked myself "Why? ", I would expect that H,I and J are partitioned as a logical extension of the main drive (C: ). A minor glitch that has been replicated over all three logical drives.

Matt

 

I thought I was being virtuous. I run chkdsk regularly now because both the hard drives that were in my computer six months ago failed, and I just barely got the data off them before they became unreadable. Bought the 320-GB drive to replace them 'cause it was immediately available and on sale (Klamath Falls is not the tech capital of the West). Then got an external drive on ebay and mended my ways. I don't think I'd like not being able to find some of the 10-yr-old images I have, even if I haven't looked at them for years...

"Risk?!" I thought, "Oh, no." Then sanity returned with my memory: on my silly upkeep schedule, I do chkdsk only 2 days after I back up everything to that external drive (which I keep disconnected from my computer at all other times). Now that I know, maybe I'll do chkdsk right after the full backup. That's easy enough to change.

Yes. I thought something like that. Thanks. I wasn't even worried.

... All of which brings up a philosophical question having to do with materialism and computer maintenance (excuse for my attachment to the pictures in the puter, vs my "non-materialistic" indifference to cat-scratched upholstery). Computers are themselves material, but, in their electromagnetic state, are the data they contain material? Some (particularly old Asian) philosophies would maintain they aren't. Some (American) people who find these philosophies quite important and valuable deprecate computers. Oh, well.

D_Spider

 

Chkdsk may not be able to fix or repair the problem. The drives may be getting "worked to death ", where the motors are overworked, not where there is a problem in the file system or even on the surface of the disk (which are those things that chkdsk checks).

Just a suggestion.

Matt

 

Matt--
Thanks for that info about hard disks wearing out mechanically. The ones that died were both 3 years old, and I use the computer every day, and that's about the life expectancy of hard drives, isn't it?

Tony--
I never said I believed that stuff ( "energy" being "spiritual," not material), and I only tried to dignify it a little by mentioning Asian philosophies. When I wrote that, the thought of people who believe in "chi" and other kinds of non-demonstrable energy must have flitted through my thoroughly organic and therefore material head. Now you have me thinking about "thought" (isn't it our experience of electrical activity in our brains?) but I ain't gonna hijack this thread.

Surferdude--
I did my full backup tonight and chkdsk right afterward. Discovered why Windows wanted to dismount the non-system (storage) partitions before checking: Windows must consider them in "use" by Copernic Desktop Search, at least insofar as it is running and ready to record any changes. I have to close Copernic to do the backup so that two of its application-data files can be backed up. I didn't bother turning it on after the backup, because I was going to restart the system to let chkdsk get at C:. When I did ">chkdsk i: /f" and the other partitions tonight, Windows did them right away. Yeah, Copernic must have been the "other process" keeping Windows from checking those partitions. Doing chkdsk right after the backup turns out to be easier as well as lower-risk.


D_Spider