Disk space alert not working correctly

As far as I can tell, the logic in this alert should work correctly, but apparently it does not as we had several drives go below the threshold that should trigger it without a peep. I'm hoping someone here might have some insight as to what's wrong with this. We're trying to get an alert to send when drive space on a Linux system goes below 1 GB free.

Find more posts tagged with

Accepted answers

All comments

esojka

You may be overcomplicating this - criteria 1,3,4,5 might be simplified if you use custom properties to ID the specific boxes you want alerted.

Also, IIRC, if you're going to use criteria fields in categories other than the main one listed (Volume) then you may need to use a complex query to pull those other fields.

ttl

Thanks - my problem with using Custom Properties is that there are more nodes that I do want to be alerted on than those that I don't. It would be an administrative nightmare to have to assign the category to every system I did want to monitor (and then be caught when Dev spun up a system without telling me and then wondered why they didn't find out when their drive ran out of space.)

zackm

On your SolarWinds website,

Settings > Manage Advanced Alerts

Click on the Alert in Question

Expand the "Read Only Attributes" section

Copy everything there and paste in here.

I think you have an "AND/OR" mixup in your selection there. The SQL under your read only attributes will confirm.

ttl

Trigger query

SELECT DISTINCT Volumes.VolumeID AS NetObjectID, Volumes.FullName AS Name FROM Nodes INNER JOIN Volumes ON (Nodes.NodeID = Volumes.NodeID) WHERE ( (Volumes.VolumeType = 'Fixed Disk') AND ((NullIf(VolumeSize,-2)-NullIf(VolumeSpaceUsed,-2)) <= 1073741824) AND (Nodes.Vendor = 'net-snmp') AND (Nodes.Vendor <> 'VMware Inc.') AND (Nodes."Type" <> 'Printer') AND ( (Volumes.Caption <> '/boot') OR (Volumes.Caption <> '/tmp') OR (Volumes.Caption <> '/sys') OR (Volumes.Caption <> '/pagecache')) AND ( NOT (Volumes.Caption LIKE '/proc%') OR NOT (Volumes.Caption LIKE '/var/lib/nfs%')) )

zackm

Try something like this and see what you get:

ALL of the following:

volumetype = fixed disk

volume size <= 1073741824

vendor = net-snmp

type <> printer

NONE of the following

caption = /boot

caption = /tmp

caption = /sys

caption = /pagecache

caption starts with /proc

caption starts with /var/lib/nfs

automag928

I keep forgetting you can view the query via the website , I keep going into the DB and viewing in the alert definitions table!