8 replies to this topic

[jgrandin]

I have a probleme when I tried to monitor my fileserver.

 

I have this problem:

 

Source: File Storage Audit Service  

Event ID: 6136 

Time: 22.08.2018 08:20:39 

User: N/A

Computer: XXX

Description: Monitoring plan: XXX

Item: XXX 

 

Server: XXX

Cannot resolve a drive letter for the object: \Device\HarddiskVolume24\. The drive record cannot be found in the mount manager's persistent name database for target host. 

This may lead to the loss of detected changes.  

 

I find nothing for this problem then i tried with dfs but i have an other problem :

 

Source: File Storage Audit Service  

Event ID: 6104 

Time: 22.08.2018 08:20:31 

User: N/A

Computer: XXX

Description: Monitoring plan: XXX

Item: XXX

 

Unable to process item: Failed to create DFS structure. 

Analyzed data:  

XXX

Contact Netwrix technical support at www.netwrix.com/support.html.

 

thanks in advance for help

 

 

[Kirill K]

Hi there,

 

As long as the volume(\Device\HarddiskVolume24\) is not assigned to a specific drive letter, Netwrix Auditor is unable to determine a bind between UNC path and physical path of a certain shared folder, so it does not matter how the item is specified in the settings of Monitoring Plan, whether it is specified like common shared folder or DFS Namespace, each volume has to be assigned to the drive letter, this is by design.

[Thierryvdv]

Hi, I have the same issue, but the path points to a shadow copy?? This with the two UNC paths that I'm monitoring (and both are reporting the same issue with the same path):

Cannot resolve a drive letter for the object: \Device\HarddiskVolumeShadowCopy637\Program Files\Internet Explorer\pris. The drive record cannot be found in the mount manager's persistent name database for target host.

 

How can I solve this?

[Kirill K]

Hi there,

 

Such warning message is expected when the shadow copy works, it creates temporary volume which is not assigned with drive letter and Netwrix Auditor returns that.

 

You should ignore the warning message or exclude it by adding the omit line at:

C:\Program Files (x86)\Netwrix Auditor\File Server Auditing\omiterrors.txt

 

*,*,*HarddiskVolumeShadowCopy*

[btran]

Cannot resolve a drive letter for the object: \Device\Ide\IdeDeviceP1T0L0-2. The drive record cannot be found in the mount manager's persistent name database for target host. 

This may lead to the loss of detected changes.

 

I have the same issue but the above explains it but how can we rid of this warning?

[Kirill K]

Hi there,

 

Do you know what device does belong to '\Device\Ide\IdeDeviceP1T0L0-2'?

[callen666]

Hi,

 

I have a similar device to btran, and it looks like it is a virtual DVD from vmware.

How do I exclude this in omitcollectlist.txt so that the 6136 error is not flagged?

[Kirill K]

How do I exclude this in omitcollectlist.txt so that the 6136 error is not flagged?

 

Take a look above, you should you use omiterrors.txt instead, it should look like this

*,*,*IdeDevice*

[btran]

Thanks for the post.  It works.  If I wanted to omit multiple entries is there a separator that I must include?

 

*,*,*IdeDevice*

*,*,*HarddiskVolume*