Index is corrupt

Microsoft.Windows.SharePoint.Services.3.0.Index_is_corrupt (Rule)

The Windows SharePoint Services Search (SPSearch) service has detected that the content index is corrupted. This can occur on either an index server or a query server. When this error occurs on an index server, the SPSearch service automatically attempts to reset and start a full update of the content index.

Knowledge Base article:

Summary

Causes

The hard drive containing the content index is out of space.
A hardware problem has corrupted the index.

Resolutions

Check the Windows NT Event.
If the problem is due to a hard drive that is full, increase the size of the hard drive or move the content index to another hard drive that has adequate space.
Use the following steps to view the default location of the index files and move the index files to a new location. Note that you can view the Windows NT Event log to determine the server on which the error occurred.
View the default index file location
- On the search server, open the Command Prompt window and navigate to the c:\program files\common files\Microsoft shared\Web server extensions\12\bin directory.
- Type the following: stsadm.exe -o spsearch –action list The location of the index files is displayed to the right of the Index location label.
Move the index files to another drive
- On the search server, open the Command Prompt window and navigate to the c:\program files\common files\Microsoft shared\Web server extensions\12\bin directory.
- Type the following: stsadm.exe -o spsearch -indexlocation 'new index="" location=""' where 'new index="" location=""' is the path to the new location where you want to move the content index.

If the problem is due to hardware errors, verify the functionality of the disk storage system that contains the index and any hardware related to that disk storage system, and perform any necessary repairs.

If the problem persists, reprovision Windows SharePoint Services Search.

Reprovisioning Windows SharePoint Services Search consists of noting the content databases that are currently being indexed by the affected search server, stopping and restarting the Windows SharePoint Services Search service to delete the index files for the search server, creating a new search database, and then re-associating the search server with the content databases.

Caution: Windows SharePoint Services cannot service search queries until search is reprovisioned

Perform the following procedures to reprovision Windows SharePoint Services Search:

Note the Content Databases used by the affected search server

On the affected search server, open the Command Prompt window and navigate to the c:\program files\common files\Microsoft shared\Web server extensions\12\bin directory.
Type the following: stsadm.exe -o spsearch –action list Note the content databases that are listed to the right of the Content databases indexed by "Servername" label.

Delete the index files

In Central Administration, on the Operations tab, in the Topology and Services section, click Services on server.
On the Services on Server page, select the search server from the Server list.
In the View column, click Stop to stop the Windows SharePoint Services Search service, and then click OK to confirm.
Note: This action permanently deletes the index files for this search server. However, when the service is stopped the search database is not deleted from the computer that is running SQL Server when the service is stopped. In the next step, you will specify the name you want to use for the new search database.
On the Services on Server page, in the Service column, click Windows SharePoint Services Search.
On the Configure Windows SharePoint Services Search Settings on the server "Servername" page, in the Search Database section, note the name of the search database listed in the Database Name box.
Note: You can delete this original search database from the SQL Server computer at a later time to reclaim the space.
Type a new name for the search database in the Database Name box, and then click OK.
On the Services on Server page, in the Windows SharePoint Services Search row, click Start.
On the Configure Windows SharePoint Services Search Settings on the server "Servername" page, click Start.

Associate content databases with the search server

For each of the content databases that were indexed by this search server (you noted them in step 2 of the Note the Content Databases that the affected search server uses procedure above), use the following steps to re-associate the content databases with the search server:

In Central Administration, on the Application Management tab, in the SharePoint Web Application Management section, click Content databases.
On the Manage Content Databases page, in the Database name column, click the name of the first content database that you want to associate with the search server.
On the Manage Content Database Settings page, in the Search Server section, select the search server from the Select Windows SharePoint Services search server list, and then click OK.
Repeat steps 2 and 3 for any additional content databases that you want to associate with the search server.

Element properties:

Target

Microsoft.Windows.SharePoint.Services.3.0.WSS.Application

Category

EventCollection

Enabled

True

Event_ID

4138

Event Source

Windows SharePoint Services 3 Search

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

Index is corrupt

Event ID {0} from Source {2} on agent computer {3} has triggered this Alert Description : {1}

Event Log

Application

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
CollectData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
DataWarehousePublishData	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
WSS.GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Windows.SharePoint.Services.3.0.Index_is_corrupt" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.SharePoint.Services.3.0.WSS.Application" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="MSWL!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>4138</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Windows SharePoint Services 3 Search</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="CollectData" TypeID="SystemCenter!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="DataWarehousePublishData" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="WSS.GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.SharePoint.Services.3.0.Index_is_corrupt.AlertMessageID"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/EventDescription$</AlertParameter2>

        <AlertParameter3>$Data/PublisherName$</AlertParameter3>

        <AlertParameter4>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter4>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>