Creating alert for disk usage large increase.

...

Select Volumes.VolumeID, Volumes.FullName

FROM Volumes

_____________________________________________________

(Entering the below, should work - Change your thresholds accordingly)

_____________________________________________________

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

AND Volumes.VolumePercentUsed > 50

All comments

Did you ever find how to set this up? I'm looking to setup the same type of alert and am having trouble deciding how to set it up. I would expect there to be a simple way through the standard alert selection. If not a Custom SQL alert can be written for something along the lines of: (just my thoughts below this is not how I would write the SQL)

Where (VolumePercentUsed - VolumePercentUsed(from last poll or average of last few polls) > 5%)

I never found a good way to do this and I have little SQL knowledge to try and create something that way. My workaround was to create a report with the output going to excel and then add the formulas to get the info I need.

Something like this could be modified into a custom SQL alert:

This is for volumes that have 10% more percent utilization today than yesterday.

Select

n.Caption

,n.IP_Address

,v.Caption

,v.VolumePercentUsed

,vu.MaxPercentDiskUsed

FROM Volumes v

JOIN Nodes n ON v.NodeID = n.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)

) vu ON v.VolumeID = vu.VolumeID AND n.NodeID = vu.NodeID

Where /* n.NodeID = 15520

AND */

v.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

Thank you lag, do you have any suggestions on how to write this into an Alert? Whats throwing me off with my minimal SQL knowledge is that when creating a Custom SQL Alert it locks in the initial SELECT statement and I'm having trouble incorporating that into the your query that I edited a bit.

Select

Nodes.Caption

,Nodes.IP_Address

,Volumes.Caption

,Volumes.VolumePercentUsed

,vu.MaxPercentDiskUsed

FROM Volumes

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

AND Volumes.VolumePercentUsed > 50

...

Select Volumes.VolumeID, Volumes.FullName

FROM Volumes

_____________________________________________________

(Entering the below, should work - Change your thresholds accordingly)

_____________________________________________________

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

AND Volumes.VolumePercentUsed > 50

That is perfect it worked for me! Thank you very much lag. I have tested and it works for us.

Below is how I have the email alerts setup if anybody else would like to use, it includes percentage available currently as well as the calculated max percentage from the SQL alert query.

The Volume below has grown by 10% since yesterday.

Node Name: ${N=SwisEntity;M=Node.Caption}

Volume Name: ${N=SwisEntity;M=Caption}

Volume Size: ${N=SwisEntity;M=VolumeSize}

Percent Available Now: ${N=SwisEntity;M=VolumePercentAvailable;F=OriginalValue} %

Percent Available Yesterday: ${SQL: SELECT MaxPercentDiskUsed FROM Volumes

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT NodeID ,VolumeID ,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate ,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND (Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed) AND Volumes.VolumePercentUsed > 50 AND Volumes.VolumeID = ${N=SwisEntity;M=VolumeID} } %

tscrip

I am fairly new to Solarwinds. Does this SQL query replace the need for an application monitor that monitors the disks?

It does for us seeing we don't have the SAM module for monitoring and all I really care about is being warned about huge disk space increases in a short time period. So I guess it depends on what level you are looking to monitor in your environment.

So I added this and I am getting alerts for Physical Memory and Idea how I can get rid of that?

Hello Trilobite Rex,

My guess on that would be if you are monitoring Physical Memory as a Volume. I always make sure to uncheck Physical and Virtual Memory as a volume and only monitor CPU & Memory. I find it gives too many false positives as memory usage fluctuates it's easier to alert off disk drives only not memory for volume utilization. For the nodes that are alerting go into manage nodes and expand it to see if Physical memory is listed as a Volume.

I checked one of the two nodes that was reporting memory and physical and virtual memory were selected. I have removed them from both of the nodes.

Thank You!

I had to take the physical and virtual off of all my nodes due to false triggering the alert, so you may need to change other nodes also to avoid mass alerts. Like glsmith said... I also just monitor the cpu and hard drive.

Is there a way to do that en masse? I really don't want to edit 300+ nodes one at a time.

That doesn't sound fun...I didn't find any way to accomplish this using the GUI. I saw a few older posts (2014) with this as a feature request but that must not have gotten enough support to be added yet. Maybe there is a way to do it using SQL, but that is over my head. If I figure out something I will let you know.

Job Security...

I'll see if I can figure something out as well. Most offices have 5 servers in them times 40.... Then there are the colo sites + 6 carry the 4 .... oh @#$!%

You could add VolumeType = 'Fixed Disk' to your alert.

Fixed Disk and Network Disk might be ones to keep, or alternatively, you could exclude the other volume types. Check your volumes table for VolumeTypes just to satisfy your curiosity.

Soooo like this

image001.png