Recommended Posts

  • LogicMonitor Staff

Windows Drive Space Alerts

By default, LogicMonitor alerts on the percentage used on any drive. This in general is fine, but sometimes not.

Let’s imagine you have a 2.2 terabytes drive.
You might have your critical threshold set at 90%, which sounds fine, until you realise that you are going to get a critical alert when you still have 220 GB free. In my case that would be a cause for some celebration, not really an urgent need to get up at 3 A.M. and delete files so the world doesn’t end.

Now Imagine your 2.2TB drive is divided up as:

C: 10 GB (OS)
D: 500 GB (Mission critical applications)
E: 1 TB (Backups)
F: 510 GB (Other Applications)

A 90% alert will give you a critical at 1GB,50GB,100GB and 51GB respectively.

Now the C: drive may be a cause for concern, but the others not so much. The two application drives you might only be concerned if they have less than 4GB free and the backup less than 10GB.

So, we decide to alert on the following

C: freespace is <1 GB
D: freespace is <4 GB 
E: freespace is <10 GB 
F: freespace is <4 GB 

You could clone the datasource so you have four copies one for each drive but this is harder to maintain in the future and does not scale well.

It would be better if you could somehow get the drive letter and assign a threshold based on that.

Logicmonitor’s scripted complex datapoint using groovy to the rescue.

The disks datasource queries the class Win32_Volume. We need to use the raw drive letter output from the WMI class so would write a groovy script like:


This returns C:,D:,E: and F:

Not much use as Logicmonitor doesn’t deal with text, only metrics. Let’s beef up the script.

drive = output['DRIVELETTER'];

freeSpaceLowerLimitGigabyte = '0';
if (drive == 'C:') 
{freeSpaceLowerLimitGigabyte = '1';}

if (drive == 'D:' || drive == 'F:') 
{freeSpaceLowerLimitGigabyte = '4';}

if (drive == 'E:') 
{freeSpaceLowerLimitGigabyte = '10';}

return freeSpaceLowerLimitGigabyte;

This returns 1,4,10 and 4 for each drive, now we have a complex datapoint that returns the lowerlimit in GB for each drive dependant on the drive letter.

Again, we can’t alert on this so we need another datapoint 

So we can use this to check if freespace is less than the freeSpaceLowerLimitGigabyte.

To do that create a CapacityAlert datapoint using this expression

if ( lt (FreeSpace, FreeSpaceLowerLimitGigabyte * 1024000000) , 1, 0)

 Which breaks down as if freespace is less than the assigned limit for that drive letter then return 1 (which you alert on.) Otherwise return 0. Alert threshold set at = 1 1 1, and we get critical alerts if:

C: freespace is <1 GB
D: freespace is <4 GB 
E: freespace is <10 GB 
F: freespace is <4 GB 


Link to post
Share on other sites

I came here to post this today.  You beat me to it! :)  Doing the same for Linux now, though haven't quite got the SNMP equivalent (by volume name) quite working yet.    

Edited by Mosh
Link to post
Share on other sites
Guest sorry

:) Sorry Mosh,but I was proud of my work on your ticket, so had to tell the world !

 I wll leave you to post the others, if you need a hand on the snmp one let me know.

Link to post
Share on other sites

On the SNMP (Linux) front, I ended up taking a slightly different approach.  I still created the lower limit data point as I did for Windows, but instead of parsing the SNMP, I created two DataSources (regular file system monitoring and mega urgent file system monitoring).  The two DSes have different filters for volumes.  The added benefit of this approach is that the mega urgent volumes can be group under a separate instance grouping, like,  "File Systems Critical to Service".  My operators then can know straight away that these are urgent to the health of the business service.

Edited by Mosh
Link to post
Share on other sites
  • 1 year later...
  • 3 weeks later...
  • 4 weeks later...
  • LogicMonitor Staff

apologies I have been away, I can share it but it will take quite a while to go through security review, it will be faster if you open a chat with support and ask for me or let me know your portal and I can import it for you

Link to post
Share on other sites
  • 3 weeks later...
  • 1 month later...
  • LogicMonitor Staff

We took a simpler approach in handling large volumes by adding a complex datapoint to the WinVolumeUsage datasource that alerts if both of the following are true: PercentFree < 5% AND FreeGB < 10 GB. So far this has worked well for us in reducing noise.

The following datapoint will equal "1" if the conditions are met, "0" if all is well:

    if(&&(gt(PercentUsed, 95), lt(FreeGB, 10)), 1, 0)

Since I hate hard-coding limits, we later modified it to pull the limits from properties so we can vary them by group/device/instance as needed. We set the default values for these properties (LowDiskSpacePercentFree & LowDiskSpaceFreeGB) at the top of our device tree.

    if(&&(gt(PercentUsed, LowDiskSpacePercentFree), lt(FreeGB, LowDiskSpaceFreeGB)), 1, 0)

Below is what this looks like. (We prefix many of our custom properties with our company name, which I obfuscated to be safe.)


  • Upvote 1
Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.