cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 8

Creating alert for disk usage large increase.

Jump to solution

Hi everyone,

I am trying to create an alert, have looked around thwack, and haven't found what I need.

What my boss requested, was to send an alert for a specific server if there was a large increase on the hard drive in a short time span. I think percentage would be best but a specific amount would also work. Below is an example of the logic I am looking for if anyone has any suggestions for either option. 

               -if disk usage increases 5% on serverA in one day then send an email

               -if disk usage increases 10GB on serverA in one day then send the email.

Thanks,

Mike

Tags (1)
0 Kudos
1 Solution

...

Select Volumes.VolumeID, Volumes.FullName

FROM Volumes

_____________________________________________________

(Entering the below, should work - Change your thresholds accordingly)

_____________________________________________________

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

AND Volumes.VolumePercentUsed > 50

View solution in original post

28 Replies
Level 12

Job Security... 

I'll see if I can figure something out as well.  Most offices have 5 servers in them times 40....  Then there are the colo sites  + 6 carry the 4 .... oh @#$!%

0 Kudos

You could add VolumeType = 'Fixed Disk' to your alert.

Fixed Disk and Network Disk might be ones to keep, or alternatively, you could exclude the other volume types. Check your volumes table for VolumeTypes just to satisfy your curiosity.

0 Kudos

Soooo like this

0 Kudos

Yes - basically that, but in TSQL.

In that inner select, you'll want to join your volumes table so that you can filter on the volumetype.

...

JOIN Volumes ON VolumeUsage.VolumeID = Volumes.VolumeID

...

AND (

Volumes.VolumeType = 'Fixed Disk' OR

Volumes.VolumeType = 'Network Disk'

)

____ or to modify my first example ____

..

Select Volumes.VolumeID, Volumes.FullName

FROM Volumes

_____________________________________________________

(Entering the below, should work - Change your thresholds accordingly)

_____________________________________________________

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

  SELECT

  NodeID

  ,VolumeID

  ,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

  ,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

  FROM VolumeUsage

  WHERE

  DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

  (Convert(Char,getdate(),101))

  GROUP BY

  NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)

) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

AND Volumes.VolumePercentUsed > 50

AND (

  Volumes.VolumeType = 'Fixed Disk' OR

  Volumes.VolumeType = 'Network Disk')

That should work without having to modify your inventory the hard way.

0 Kudos
Level 12

Is there a way to do that en masse?  I really don't want to edit 300+ nodes one at a time.

0 Kudos

That doesn't sound fun...I didn't find any way to accomplish this using the GUI. I saw a few older posts (2014) with this as a feature request but that must not have gotten enough support to be added yet. Maybe there is a way to do it using SQL, but that is over my head. If I figure out something I will let you know.

0 Kudos
Level 12

So I added this and I am getting alerts for Physical Memory and Idea how I can get rid of that?

0 Kudos

Hello Trilobite Rex,

My guess on that would be if you are monitoring Physical Memory as a Volume. I always make sure to uncheck Physical and Virtual Memory as a volume and only monitor CPU & Memory. I find it gives too many false positives as memory usage fluctuates it's easier to alert off disk drives only not memory for volume utilization. For the nodes that are alerting go into manage nodes and expand it to see if Physical memory is listed as a Volume.

pastedImage_0.png

I checked one of the two nodes that was reporting memory and physical and virtual memory were selected.  I have removed them from both of the nodes. 

Thank You!

0 Kudos

I had to take the physical and virtual off of all my nodes due to false triggering the alert, so you may need to change other nodes also to avoid mass alerts. Like glsmith said... I also just monitor the cpu and hard drive.

0 Kudos
Level 7

I am fairly new to Solarwinds. Does this SQL query replace the need for an application monitor that monitors the disks?

0 Kudos

It does for us seeing we don't have the SAM module for monitoring and all I really care about is being warned about huge disk space increases in a short time period. So I guess it depends on what level you are looking to monitor in your environment. 

0 Kudos
Level 12

Something like this could be modified into a custom SQL alert:

This is for volumes that have 10% more percent utilization today than yesterday.

Select

n.Caption

,n.IP_Address

,v.Caption

,v.VolumePercentUsed

,vu.MaxPercentDiskUsed

FROM Volumes v

JOIN Nodes n ON v.NodeID = n.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)

) vu ON v.VolumeID = vu.VolumeID AND n.NodeID = vu.NodeID

Where /* n.NodeID = 15520

AND */

v.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

Thank you lag, do you have any suggestions on how to write this into an Alert? Whats throwing me off with my minimal SQL knowledge is that when creating a Custom SQL Alert it locks in the initial SELECT statement and I'm having trouble incorporating that into the your query that I edited a bit.

pastedImage_0.png

Select

Nodes.Caption

,Nodes.IP_Address

,Volumes.Caption

,Volumes.VolumePercentUsed

,vu.MaxPercentDiskUsed

FROM Volumes

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

AND Volumes.VolumePercentUsed > 50

0 Kudos

...

Select Volumes.VolumeID, Volumes.FullName

FROM Volumes

_____________________________________________________

(Entering the below, should work - Change your thresholds accordingly)

_____________________________________________________

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

AND Volumes.VolumePercentUsed > 50

View solution in original post

That is perfect it worked for me! Thank you very much lag. I have tested and it works for us.

Below is how I have the email alerts setup if anybody else would like to use, it includes percentage available currently as well as the calculated max percentage from the SQL alert query.

The Volume below has grown by 10% since yesterday. 

Node Name: ${N=SwisEntity;M=Node.Caption}

Volume Name: ${N=SwisEntity;M=Caption}

Volume Size:  ${N=SwisEntity;M=VolumeSize}

Percent Available Now: ${N=SwisEntity;M=VolumePercentAvailable;F=OriginalValue} %

Percent Available Yesterday: ${SQL: SELECT MaxPercentDiskUsed FROM Volumes

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT NodeID ,VolumeID ,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate ,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND (Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed) AND Volumes.VolumePercentUsed > 50 AND Volumes.VolumeID = ${N=SwisEntity;M=VolumeID} } %

Just updating the email variables I had mislabeled the Percent Available yesterday SQL and it was giving percent used not available also rounded the percentages.

The Volume below has grown by 10% since yesterday. 

Node Name: ${N=SwisEntity;M=Node.Caption}

Volume Name: ${N=SwisEntity;M=Caption}

Volume Size:  ${N=SwisEntity;M=VolumeSize}

Percent Available Yesterday: ${SQL: SELECT

(100 - (Round(MaxPercentDiskUsed, 0)))

FROM Volumes

JOIN Nodes ON Volumes.NodeID = Nodes.NodeID

JOIN(

SELECT

NodeID

,VolumeID

,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101) AS SummaryDate

,MAX(PercentDiskUsed) AS MaxPercentDiskUsed

FROM VolumeUsage

WHERE

DateTime BETWEEN dateadd(Day, -1, (Convert(Char,getdate(),101))) AND

(Convert(Char,getdate(),101))

GROUP BY

NodeID,VolumeID,CONVERT(DateTime,Floor(Cast((DateTime) as Float)),101)) vu ON Volumes.VolumeID = vu.VolumeID AND Nodes.NodeID = vu.NodeID

Where

Volumes.VolumePercentUsed > 1.1*(vu.MaxPercentDiskUsed)

AND Volumes.VolumePercentUsed > 50 AND Volumes.VolumeID = ${N=SwisEntity;M=VolumeID}

} %

Percent Available Now: ${SQL:Select Round('${N=SwisEntity;M=VolumePercentAvailable;F=OriginalValue}', 0)} %

Disk Space Available Now: ${N=SwisEntity;M=VolumeSpaceAvailable}

0 Kudos

hi, how did you add this query in custom sql alert as it does not give options to type select option... please help..

thanks in advance

0 Kudos

At the top where you can change what you want to alert on you'll need to change to custom sql alert like below.

pastedImage_0.png

0 Kudos

Thanks for this, very useful. The email action doesnt work for me, the 'percent available yesterday' does work - just sends the SQL. Any clue?

0 Kudos