What would you consider a rapid rate?
I would also like to know how to alert for rapid increase in disk usage.
I would consider rapid growth to be an increase of 10% disk usage over the past 30 minutes.
Along with alerting for the rapid disk usage growth, can I specify what or who is causing the issue.
Was there ever any alert created for this?
I have this same question. Did anyone find a solution for this?
It has been done in custom SQL/SWQL queries. Basically you need to determine the size of your window (lets say an hour), what growth percent would you consider "alarming" (lets say 10% over that hour) and then write a query to find the value from an hour ago, divide that by the current value, and if the result is greater than 1.1 trigger an alert.
In practice though this kind of alerts generate WAY more heat than light where I have seen them in use.
For example, I would trigger them all the time while doing solarwinds upgrades since the installers tend to be a one time jump of several GB on disk. If you make the time window too large you miss the things you are worried about like db logs suddenly filling up, but if you make the window too narrow you have problems with one time bumps. In order to make this type of alert more useful I have had to do things like check 3-4 timestamps along the window and try to measure if the growth trend stays high across all of them (also keeping in mind that disk space is only polled once every 15 minutes in most environments). All told it gets to be pretty complex, but doable.
The SAM Appinisght for SQL template does daily growth rate calculations for you automatically so you could use that for your DB or logs too if that is the use case you have in mind, but it is doing it across 24 hours so it has limited utility in catching those fast bursts.
Try to make an alert out of this SQL query. (Createa a Custom SQL alert and choose Volumes as "target"):
SELECT Volumes.FullName, Volumes.VolumeID FROM Volumes
Inner join [dbo].[VolumeUsage_Detail] D on Volumes.VolumeID=d.VolumeID
D.datetime>Dateadd(HOUR,-2,Getdate()) -- In how many hours
group by Volumes.FullName, Volumes.VolumeID
HAVING Max(D.PercentDiskUsed)-Min(D.PercentDiskUsed)>10 -- Growth to look for in percent
Adjust hours and percent growth as you want.