Windows Drive Space Alerts

Windows Drive Space Alerts

By default, LogicMonitor alerts on the percentage used on any drive. This in general is fine, but sometimes not.

Let’s imagine you have a 2.2 terabytes drive.
You might have your critical threshold set at 90%, which sounds fine, until you realise that you are going to get a critical alert when you still have 220 GB free. In my case that would be a cause for some celebration, not really an urgent need to get up at 3 A.M. and delete files so the world doesn’t end.

Now Imagine your 2.2TB drive is divided up as:

C: 10 GB (OS)
D: 500 GB (Mission critical applications)
E: 1 TB (Backups)
F: 510 GB (Other Applications)

A 90% alert will give you a critical at 1GB,50GB,100GB and 51GB respectively.

Now the C: drive may be a cause for concern, but the others not so much. The two application drives you might only be concerned if they have less than 4GB free and the backup less than 10GB.

So, we decide to alert on the following

C: freespace is <1 GB
D: freespace is <4 GB 
E: freespace is <10 GB 
F: freespace is <4 GB 

You could clone the datasource so you have four copies one for each drive but this is harder to maintain in the future and does not scale well.

It would be better if you could somehow get the drive letter and assign a threshold based on that.

Logicmonitor’s scripted complex datapoint using groovy to the rescue.

The disks datasource queries the class Win32_Volume. We need to use the raw drive letter output from the WMI class so would write a groovy script like:

Drive=output["DRIVELETTER"];
return(Drive);

This returns C:,D:,E: and F:

Not much use as Logicmonitor doesn’t deal with text, only metrics. Let’s beef up the script.

drive = output['DRIVELETTER'];

freeSpaceLowerLimitGigabyte = '0';
                       
if (drive == 'C:') 
{freeSpaceLowerLimitGigabyte = '1';}

if (drive == 'D:' || drive == 'F:') 
{freeSpaceLowerLimitGigabyte = '4';}

if (drive == 'E:') 
{freeSpaceLowerLimitGigabyte = '10';}

return freeSpaceLowerLimitGigabyte;

This returns 1,4,10 and 4 for each drive, now we have a complex datapoint that returns the lowerlimit in GB for each drive dependant on the drive letter.

Again, we can’t alert on this so we need another datapoint 

So we can use this to check if freespace is less than the freeSpaceLowerLimitGigabyte.

To do that create a CapacityAlert datapoint using this expression

if ( lt (FreeSpace, FreeSpaceLowerLimitGigabyte * 1024000000) , 1, 0)

 Which breaks down as if freespace is less than the assigned limit for that drive letter then return 1 (which you alert on.) Otherwise return 0. Alert threshold set at = 1 1 1, and we get critical alerts if:

C: freespace is <1 GB
D: freespace is <4 GB 
E: freespace is <10 GB 
F: freespace is <4 GB