Can someone check my logic on this alert please

trilobite_rex

Hi.  I have been tasked with creating an alert that will email out when a c$ (fixed) is less than 1 gb.  Then I was asked to create a special one for domain controllers only same size parameter.  I have set the primary application of "Domain Controller" as what to poll against.  I just want some assurances that this is set up correctly. 

Alert me when the free space of the C drive is less than 1gb

Description of alert:

This alert reports when the free space of the C drive is less than 1gb

Type of Property to monitor

Volume

Enabled(On/Off):

ON

Evaluation Frequency of alert:

Every hour

Severity of alert:

Warning

Alert Custom Properties: (0)

No Alert Custom Properties defined

Alert Limitation Category

No Limitation

Trigger Condition:

Edit

The actual trigger condition:
All child conditions must be satisfied (AND)
Volume - Caption - contains - C:\ Label:
Volume - Available space - is less than or equal to - 1073741824
Volume - Volume Type - is equal to - Fixed Disk
Nodes Custom Properties - Primary_Application - is not equal to - Domain Controller

Reset Condition:

Edit

When the trigger condition is no longer true

Time of Day schedule:

Edit

Alert is always enabled

Trigger Action:

Edit

Escalation Level 1

1. 1. Send an Email/Page (There is less than 1gb free space on volume ${FullName})

Reset Action:

Edit

1. 1. Send an Email/Page (There is less than 1gb free space on volume ${FullName})

Alert Integration

Name of alert:

Edit

Alert me when the free space of the C drive is less than 1gb on a domain controller

Description of alert:

This alert reports when the free space of the C drive is less than 1gb on a domain controller

Type of Property to monitor

Volume

Enabled(On/Off):

ON

Evaluation Frequency of alert:

Every 30 minutes

Severity of alert:

Critical

Alert Custom Properties: (0)

No Alert Custom Properties defined

Alert owner (user who created this alert):

SSDUS01\JAltomari

Alert Limitation Category

No Limitation

Trigger Condition:

Edit

The actual trigger condition:
All child conditions must be satisfied (AND)
Volume - Caption - contains - C:\ Label:
Volume - Available space - is less than or equal to - 1073741824
Volume - Volume Type - is equal to - Fixed Disk
Nodes Custom Properties - Primary_Application - is equal to - Domain Controller

Reset Condition:

Edit

When the trigger condition is no longer true

Time of Day schedule:

Edit

Alert is always enabled

Trigger Action:

Edit

Escalation Level 1

1. 1. Send an Email/Page (There is less than 1gb free space on volume ${FullName})

Reset Action:

Edit

1. 1. Send an Email/Page (There is less than 1gb free space on volume ${FullName})

Alert Integration

KMSigma.SWI

Personally, I would use this logic:

Alert Scope:

Only apply to Windows Servers (Vendor = 'Windows') AND Non-Domain Controllers (Domain Role does not contain 'Domain Controller')

Trigger Conditions:

Volume Caption starts with C:\

Available Space is less than 1073741825 bytes (1GB ~ 1024 * 1024 * 1024)

Volume Type is Fixed Disk (or FixedDisk in my environment).

Then you can copy this alert and just change the Domain Role to show Domain Controllers to create one for Domain Controllers.