David Lee

Windows Drive Space Alerts

Recommended Posts

Windows Drive Space Alerts

By default, LogicMonitor alerts on the percentage used on any drive. This in general is fine, but sometimes not.

Let’s imagine you have a 2.2 terabytes drive.
You might have your critical threshold set at 90%, which sounds fine, until you realise that you are going to get a critical alert when you still have 220 GB free. In my case that would be a cause for some celebration, not really an urgent need to get up at 3 A.M. and delete files so the world doesn’t end.

Now Imagine your 2.2TB drive is divided up as:

C: 10 GB (OS)
D: 500 GB (Mission critical applications)
E: 1 TB (Backups)
F: 510 GB (Other Applications)

A 90% alert will give you a critical at 1GB,50GB,100GB and 51GB respectively.

Now the C: drive may be a cause for concern, but the others not so much. The two application drives you might only be concerned if they have less than 4GB free and the backup less than 10GB.

So, we decide to alert on the following

C: freespace is <1 GB
D: freespace is <4 GB 
E: freespace is <10 GB 
F: freespace is <4 GB 


You could clone the datasource so you have four copies one for each drive but this is harder to maintain in the future and does not scale well.

It would be better if you could somehow get the drive letter and assign a threshold based on that.

Logicmonitor’s scripted complex datapoint using groovy to the rescue.

The disks datasource queries the class Win32_Volume. We need to use the raw drive letter output from the WMI class so would write a groovy script like:

Drive=output["DRIVELETTER"];
return(Drive);

This returns C:,D:,E: and F:

Not much use as Logicmonitor doesn’t deal with text, only metrics. Let’s beef up the script.

drive = output['DRIVELETTER'];

freeSpaceLowerLimitGigabyte = '0';
                       
if (drive == 'C:') 
{freeSpaceLowerLimitGigabyte = '1';}

if (drive == 'D:' || drive == 'F:') 
{freeSpaceLowerLimitGigabyte = '4';}

if (drive == 'E:') 
{freeSpaceLowerLimitGigabyte = '10';}

return freeSpaceLowerLimitGigabyte;

This returns 1,4,10 and 4 for each drive, now we have a complex datapoint that returns the lowerlimit in GB for each drive dependant on the drive letter.

Again, we can’t alert on this so we need another datapoint 

So we can use this to check if freespace is less than the freeSpaceLowerLimitGigabyte.

To do that create a CapacityAlert datapoint using this expression

if ( lt (FreeSpace, FreeSpaceLowerLimitGigabyte * 1024000000) , 1, 0)

 Which breaks down as if freespace is less than the assigned limit for that drive letter then return 1 (which you alert on.) Otherwise return 0. Alert threshold set at = 1 1 1, and we get critical alerts if:


C: freespace is <1 GB
D: freespace is <4 GB 
E: freespace is <10 GB 
F: freespace is <4 GB 

one.png

Share this post


Link to post
Share on other sites

I came here to post this today.  You beat me to it! :)  Doing the same for Linux now, though haven't quite got the SNMP equivalent (by volume name) quite working yet.    

Edited by Mosh

Share this post


Link to post
Share on other sites
Guest sorry

:) Sorry Mosh,but I was proud of my work on your ticket, so had to tell the world !

 I wll leave you to post the others, if you need a hand on the snmp one let me know.

Share this post


Link to post
Share on other sites

On the SNMP (Linux) front, I ended up taking a slightly different approach.  I still created the lower limit data point as I did for Windows, but instead of parsing the SNMP, I created two DataSources (regular file system monitoring and mega urgent file system monitoring).  The two DSes have different filters for volumes.  The added benefit of this approach is that the mega urgent volumes can be group under a separate instance grouping, like,  "File Systems Critical to Service".  My operators then can know straight away that these are urgent to the health of the business service.

Edited by Mosh

Share this post


Link to post
Share on other sites
Guest
You are commenting as a guest. If you have an account, please sign in.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoticons maximum are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.