Diagnosing Repeated CHKDSK Errors

[Shump]

Hello all!

We have a variety of servers running Windows Server 2003 Standard SP2. On two -- and only two -- of them we are having a problem with chkdsk repeatedly finding errors with the file system.

We have an automated script that runs a read-only chkdsk on each of our servers on a daily basis as a precautionary measure, due to file system corruption we experienced once in the past. On most of our servers, it routinely finds no problems. However, on these two, it repeatedly finds errors. When it does, we will take the server offline and run a full chkdsk allowing it to fix the errors. And then run another chkdsk afterward to verify that the errors are gone. And it always shows "clean." But then within a couple of days they come back.

I have done extensive hardware diagnostics to verify that there are no failures happening with the system hardware that could be leading to these problems, and they all report clean. In addition, the fact that this is two separate servers leads me to think it unlikely that we have two simultaneous hardware failures on two separate servers that are going undetected.

There is a commonality between these two servers however. They are both involved in a nightly data processing process that writes a great deal of data to both servers. That leads me to suspect that something is happening during this process that is causing corruption in the file system. But with just a generic "errors were found" output from chkdsk, it's hard to know where to start looking in tracking down the problem.

Looking in the Event Viewer is yielding no information. The only thing that is logged is a single event noting that chkdsk was run in read-only mode.

Can anyone offer some advice on either how to pry more information out of chkdsk on the specific files, folders, etc. that are showing errors or inconsistencies? Or perhaps recommend a third-party tool that could provide more information on problems the file system has? (These are NTFS volumes, BTW, and we are not doing surface scans for bad sectors during this process.)

Does anyone have any more general thoughts on possible causes for repeated errors such as these?

Thanks so much!

- Tom

[Shump]

Additional Information:

I dug up the following Event Viewer log from the last time we actually took the server down and did a full chkdsk /f on it. Does this information shed any light on what might be the source of the problems? The hexadecimal file identifiers doesn't really help me much in determining where the problem lies.

---

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 10/26/2009
Time: 11:49:56 PM
User: N/A
Computer: STEWIE
Description:
Checking file system on C:
The type of the file system is NTFS.


A disk check has been scheduled.
Windows will now check the disk.
Cleaning up instance tags for file 0xda175.
Cleaning up instance tags for file 0x108d06.
Cleaning up instance tags for file 0x17b0a4.
Cleaning up instance tags for file 0x17d3b1.
Cleaning up minor inconsistencies on the drive.
Cleaning up 20 unused index entries from index $SII of file 0x9.
Cleaning up 20 unused index entries from index $SDH of file 0x9.
Cleaning up 20 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Windows has made corrections to the file system.

104856223 KB total disk space.
89527512 KB in 1636225 files.
642248 KB in 51235 indexes.
0 KB in bad sectors.
1797055 KB in use by the system.
65536 KB occupied by the log file.
12889408 KB available on disk.

4096 bytes in each allocation unit.
26214055 total allocation units on disk.
3222352 allocation units available on disk.

Internal Info:
e0 d3 19 00 b0 bf 19 00 81 c0 28 00 00 00 00 00 ..........(.....
c9 01 00 00 02 00 00 00 5e 03 00 00 00 00 00 00 ........^.......
d6 59 78 7f 00 00 00 00 a6 8c a1 a0 03 00 00 00 .Yx.............
9c 4b ab 76 00 00 00 00 00 00 00 00 00 00 00 00 .K.v............
00 00 00 00 00 00 00 00 fa 41 19 a1 04 00 00 00 .........A......
10 b0 0f 8f 00 00 00 00 3d 9f 82 7c 18 00 00 00 ........=..|....
81 f7 18 00 00 00 00 00 00 60 53 58 15 00 00 00 .........`SX....

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.