Locked
Discussion interactions are currently paused.
Windows Drive Space Alerts
Windows Drive Space Alerts
By default, LogicMonitor alerts on the percentage used on any drive. This in general is fine, but sometimes not.
Let’s imagine you have a 2.2 terabytes drive.
You might have your critical threshold set at 90%, which sounds fine, until you realise that you are going to get a critical alert when you still have 220 GB free. In my case that would be a cause for some celebration, not really an urgent need to get up at 3 A.M. and delete files so the world doesn’t end.
Now Imagine your 2.2TB drive is divided up as:
C: 10 GB (OS)
D: 500 GB (Mission critical applications)
E: 1 TB (Backups)
F: 510 GB (Other Applications)
A 90% alert will give you a critical at 1GB,50GB,100GB and 51GB respectively.
Now the C: drive may be a cause for concern, but the others not so much. The two application drives you might only be concerned if they have less than 4GB free and the backup less than 10GB.
So, we decide to alert on the following
C: freespace is <1 GB
D: freespace is <4 GB
E: freespace is <10 GB
F: freespace is <4 GB
You could clone the datasource so you have four copies one for each drive but this is harder to maintain in the future and does not scale well.
It would be better if you could somehow get the drive letter and assign a threshold based on that.
Logicmonitor’s scripted complex datapoint using groovy to the rescue.
The disks datasource queries the class Win32_Volume. We need to use the raw drive letter output from the WMI class so would write a groovy script like:
Drive=output["DRIVELETTER"];
return(Drive);
This returns C:,D:,E: and F:
Not much use as Logicmonitor doesn’t deal with text, only metrics. Let’s beef up the script.
drive = output['DRIVELETTER'];
freeSpaceLowerLimitGigabyte = '0';
if (drive == 'C:')
{freeSpaceLowerLimitGigabyte = '1';}
if (drive == 'D:' || drive == 'F:')
{freeSpaceLowerLimitGigabyte = '4';}
if (drive == 'E:')
{freeSpaceLowerLimitGigabyte = '10';}
return freeSpaceLowerLimitGigabyte;
This returns 1,4,10 and 4 for each drive, now we have a complex datapoint that returns the lowerlimit in GB for each drive dependant on the drive letter.
Again, we can’t alert on this so we need another datapoint
So we can use this to check if freespace is less than the freeSpaceLowerLimitGigabyte.
To do that create a CapacityAlert datapoint using this expression
if ( lt (FreeSpace, FreeSpaceLowerLimitGigabyte * 1024000000) , 1, 0)
Which breaks down as if freespace is less than the assigned limit for that drive letter then return 1 (which you alert on.) Otherwise return 0. Alert threshold set at = 1 1 1, and we get critical alerts if:
C: freespace is <1 GB
D: freespace is <4 GB
E: freespace is <10 GB
F: freespace is <4 GB
Kevin Ford
·7 years agoWe took a simpler approach in handling large volumes by adding a complex datapoint to the WinVolumeUsage datasource that alerts if both of the following are true: PercentFree < 5% AND FreeGB < 10 GB. So far this has worked well for us in reducing noise.
The following datapoint will equal "1" if the conditions are met, "0" if all is well:
if(&&(gt(PercentUsed, 95), lt(FreeGB, 10)), 1, 0)
Since I hate hard-coding limits, we later modified it to pull the limits from properties so we can vary them by group/device/instance as needed. We set the default values for these properties (LowDiskSpacePercentFree & LowDiskSpaceFreeGB) at the top of our device tree.
if(&&(gt(PercentUsed, LowDiskSpacePercentFree), lt(FreeGB, LowDiskSpaceFreeGB)), 1, 0)
Below is what this looks like. (We prefix many of our custom properties with our company name, which I obfuscated to be safe.)
Michael Rodrigues
·7 years agoThis is through security review now! Thanks.
LM User
·7 years agoPMWWJN appears to still be undergoing a security review. Any way to speed this up?
David_Lee
OP7 years agoI have published it to the exchange with the locator code of PMWWJN, you can use this code to import it directly into your account
David_Lee
OP7 years agoapologies I have been away, I can share it but it will take quite a while to go through security review, it will be faster if you open a chat with support and ask for me or let me know your portal and I can import it for you
LM User
·7 years ago@David Lee I am hoping that you might share your export for Windows Drive Space alerts with me? I think it would be very helpful in my environment. Thanks!
Mosh
·7 years ago@mkerfoot I haven't published ours, but happy to send an export. Will DM you.
mkerfoot
·7 years ago@Mosh @David Lee Has this been datasource been published by chance?
Mosh
·9 years agoOn the SNMP (Linux) front, I ended up taking a slightly different approach. I still created the lower limit data point as I did for Windows, but instead of parsing the SNMP, I created two DataSources (regular file system monitoring and mega urgent file system monitoring). The two DSes have different filters for volumes. The added benefit of this approach is that the mega urgent volumes can be group under a separate instance grouping, like, "File Systems Critical to Service". My operators then can know straight away that these are urgent to the health of the business service.
LM User
·9 years ago:)/emoticons/smile@2x.png 2x" title=":)" width="20"> Sorry Mosh,but I was proud of my work on your ticket, so had to tell the world !
I wll leave you to post the others, if you need a hand on the snmp one let me know.
Mosh
·9 years agoI came here to post this today. You beat me to it! :)/emoticons/smile@2x.png 2x" title=":)" width="20"> Doing the same for Linux now, though haven't quite got the SNMP equivalent (by volume name) quite working yet.