This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Volume Usage Spike Detection Alert

I saw a Feature request this morning for Disk Growth Monitoring and figured something could be done. After trying to find the thread I came across another pages where folks were needing/trying to achieve the same.

So now I have an alert that checks the last two statistic polls of volumes for & used. The values are subtracted to get the difference in % use change between the two polls.

Threshold is set to 10, so anything over 10% change in % use will trigger the alert.

conditions-summary.png

On the reset, the inverse clause where less than 1% change needs to be met to reset this alert. The timing for the reset is 35 minutes. So it goes trough 2, possibly 3 polls to compare the change in % use to the < 1%. So if it is not less than 1% the alert is not reset and the alert continues as Triggered and checking the statistic polls until there is less than 1% change (i.e. whatever is writing to the disk is finally done).

TriggerCheck.png

The other option would be to use this for trigger notification only, to allow for a system check/remediation.

:: Alert Email Setup ::

===============================================================================

Subject

Alert: Volume ${N=SwisEntity;M=FullName} on ${N=SwisEntity;M=Node.Caption} has had a spike in % Used between the last two statistic polls.

===============================================================================

Body

Volume ${N=SwisEntity;M=FullName} on ${N=SwisEntity;M=Node.Caption} has had a spike in % Used between the last two statistic polls.

Current % Used: ${N=SwisEntity;M=VolumePercentUsed}

Current Space Available: ${N=SwisEntity;M=VolumeSpaceAvailable}

Previous Statistic: ${N=SwisEntity;M=PREVIOUS(StatCollection)}

Volume size: ${N=SwisEntity;M=VolumeSize}

Volume Type: ${N=SwisEntity;M=Type}

Node IP:  ${N=SwisEntity;M=Node.IP_Address}

Machine Type: ${N=SwisEntity;M=Node.MachineType}

Alert Trigger Time: ${N=Alerting;M=AlertTriggerTime;F=DateTime}.

View full object details here: ${N=SwisEntity;M=DetailsUrl}.

View full alert details here: ${N=Alerting;M=AlertDetailsUrl}

Click here to acknowledge the alert: ${N=Alerting;M=AcknowledgeUrl}

This message was brought to you by the alert named: ${N=Alerting;M=AlertName}

===============================================================================

Since disk usage should not change unless there is a known or planned event you can focus this on certain disks by adding a custom property. Also for testing the trigger, I used the value of  > .001 to confirm that I could actually get a proper trigger. I started with this information in a report to confirm my data then translated this for the Custom SQL Volume Report.

You will need adjust the SMTP Server and Email Addresses in the alert setup.

If you have any questions send me a msg here on Thwack!

Enjoy!!!

-CharlesH

Loop1 Systems: SolarWinds Training and Professional Services

Parents
  •  

    How would I edit the Trigger to include a custom property of nodes not to be triggered by this alert? I have around 26 Unix systems that are previsioned with very small partitions that peak during software run on those server but the disk is released once the run is over.

    So it is confirmed that it's not a problem thus needs to be adjusted at the alert level. Let me know because I couldn't figure out the SQL script changes to make this happen.

    thanks,

Reply
  •  

    How would I edit the Trigger to include a custom property of nodes not to be triggered by this alert? I have around 26 Unix systems that are previsioned with very small partitions that peak during software run on those server but the disk is released once the run is over.

    So it is confirmed that it's not a problem thus needs to be adjusted at the alert level. Let me know because I couldn't figure out the SQL script changes to make this happen.

    thanks,

Children
No Data