Pages

Sunday, October 14, 2012

Monitoring free drive space with Windows Server 2008 R2 and Performance Monitor

Problem

You would like to monitor free drive space on a server with the native features of Windows Server 2008 R2 without having to purchase monitoring software such as SolarWinds, SCOM, etc.

Solution

I’ve found myself in plenty of situations where I need to set up a quick way of monitoring free drive space on various versions of Windows Server because I either don’t have access to the monitoring application that the company uses, lack of licenses for the monitoring application to add the new host or the company simply does not have monitoring.  When this situation comes across my deployments, I simply use the native Performance Monitor feature of Windows Server 2008 R2 to monitor and send an email alert to email addresses.  Note that this feature is also available in Windows Server 2003 but this blog post will just cover 2008.

Note that Microsoft has various articles that covers setting this up so I’ll include some of the links here:

HOW TO: Configure a Low Disk Space Alert by Using the Performance Logs and Alerts Feature in Windows Server 2003
p://support.microsoft.com/kb/324796

Configure Windows Server 2008 to Notify you when Certain Events Occur
http://technet.microsoft.com/en-us/magazine/ff458614.aspx

Create a Data Collector Set to Monitor Performance Counters
http://technet.microsoft.com/en-us/library/cc722414.aspx

The first step in setting the monitoring up is to open Performance Monitor and create an alert so begin by opening up the application in Administrative Tools then navigate to Data Collector Sets –> User Defined:

clip_image002

Right click on the User Defined node and select New –> Data Collector Set:

image

In the Create new Data Collector Set, type in a name for this collector, select Create manually (Advanced) and click Next:

clip_image002[4]

Select Performance Counter Alert and click Next:

clip_image002[6]

Click on the Add… button:

clip_image002[8]

Navigate to the Logical Disk selection:

clip_image002[10]

You’ll find various counters in this section and whether you prefer to use % Free Space or Free Megabytes will be based on the type of application and drive size you’ll be monitoring.  I personally prefer Free Megabytes because the drive I’m monitoring is a 1TB drive and setting up a hard threshold based on a constant value seems to make more sense:

clip_image002[12]

Note the logical drives are listed under the Instances of selected object so select the ones you’d like to monitor:

clip_image002[14]

Clicking on OK will bring you back to the Create new Data Collector Set window.  Proceed with setting a threshold:

clip_image002[16]

Notice how I’ve set the Alert when to Below and the Limit to 2048.  This simply means I’m setting a threshold to 2GB for each of the drives. Proceed with clicking the Next button when you’ve configured all of the drives’ thresholds:

clip_image002[18]

Unless you have restrictions on the service account where the default is SYSTEM, proceed by click on Finish:

clip_image002[20]

It’s not necessary to verify the Run As account but I like to double check just to be sure so right click on the new Data Collector Set and select Properties:

image

Under the General tab, ensure that Run As is the account you wanted to run this Data Collector Set as:

image

With the Data Collector Set account verified, notice how a new collector is now set up:

clip_image002[22]

Continue by right clicking on the data collector and choose properties:

image

Navigate to the Alert Action tab and select the Log an entry in the application event log:

clip_image002[24]

With the data collector configured, the next step is to set the collector to start after server restarts so begin by navigating to Task Scheduler –> Task Scheduler Library –> Microsoft –> Windows –> PLA, right click on the collector task and select Properties:

image

Navigate to the Triggers tab and click on the New button:

image

Click on the New button and select At startup for Begin the task and ensure that Enabled is selected:

image

You should now see a new trigger listed, proceed to save the trigger by clicking on the OK button:

clip_image002[1]

Start the data collector set by right clicking on the object and selecting Start:

image

Unlike Windows Server 2003, the data collector DOES NOT write logs to the application logs but rather the following log:

Applications and Services Logs/Microsoft/Windows/Diagnosis-PLA/Operational

image

Note that I changed the threshold from 2048 to 20480 so that I could trigger the alert:

image

Now that we’ve generated an information event with the ID 2031 in the logs, we can proceed with setting up a task to send an email to an address.  Proceed by right clicking on the event and select Attach Task To This Event…:

image

Give the task a meaningful name and proceed by clicking the Next button:

clip_image002[26]

There isn’t much to change in the When an Event Is Logged so continue by clicking on the Next button:

clip_image002[28]

In the Action step, change the action from Start a program to Send an e-mail:

clip_image002[30]

clip_image002[32]

Fill in the appropriate fields (make sure this server can relay mail off of your SMTP server:

image

Complete the wizard:

clip_image002[34]

clip_image002[36]

What’s important to note is that the task we created is automatically assigned the account you’re logged in as to run the service and is set to run only when the user is logged on which probably isn’t what most of us want to navigate to Task Scheduler –> Task Scheduler Library –> Event Viewer Tasks:

image

Right click on the e-mail notification event that was created and select Properties:

image

From within the properties window under the General tab, click on Change User or Group…:

image

Change the account to service account (local or domain) that is a local administrator on the server and is allowed to run as a service (Log on as batch job permissions):

image

In this example, I created a service account named svc_monitoring:

clip_image002[3]

image

Save the configuration by click on the OK button.

The last step to configure for this task is to set it to run after server restarts so open up the properties of the task and navigate to the Actions tab:

image

Click on the New button and select At startup for Begin the task and ensure that Enabled is selected:

image

Proceed with saving the settings by clicking OK:

image

Trigger an event to test and you should see an email similar to the following:

image

I hope this helps anyone looking for a quick and dirty way to monitor free drive space on their servers.

23 comments:

Anonymous said...

Hi, nothing serious, but on your 3rd to last screencap you've forgotten to censor your domain.

Good guide though.

Anonymous said...

Terence, when a server reboots, this alerting stops. How do you set it up to automatically restart upon a reboot?

Anonymous said...

To get the Data Collector Set to startup after a reboot, use Task Scheduler and browse to Task Scheduler Library | Microsoft | Windows | PLA | "Monitor Drive Space". Properties of "Monitor Drive Space", Triggers Tab| New | Begin the task: At startup. Be sure Enabled is checked, click ok. Also, for the email alert, I had to use the Administrator account to get a rely off of my local exchange server to work.

Anonymous said...

This is great, thanks!

I think the final step has a mistake though (unless I'm misreading). I don't think you want to set the task which sends the email to trigger on startup, just on the event. It looks like you're triggering both, which generates an email when the server restarts.

Anonymous said...

Great post Terence, thank you!

I have a question:

I want to use this method to send different alerts for different situations.
Lets say I want one alert for low free disk space, and another different one for low memory usage.
The problem is that both "fires" the same event id - 2031.
So how can I cause them to fire different event ids?

Thanks!
Eran.

Giovanni Galasso said...

This was a really useful write up. Thanks very much! I did notice a few errors/typos towards the bottom, but otherwise I thought it was extremely helpful.

Unknown said...

http://www.lgnetworksinc.com/it-consulting/windows-server-2008-consulting/ "Windows Server 2008 provides a solid foundation for all of your server workload and application requirements while being easy to deploy and manage."
Windows Server 2008 Support

Anonymous said...

I have the same startup problem, When i reboot the machine it generate the low disk alert as it was triggered startup the machine. I think it should only triggered when the event occur. Please let me know if i am wrong.

Thanks

Anonymous said...

It's because in the work instructions he has you add an "at start up" trigger for the send an email event... I think this is an error... As he already has us setup that trigger on the event trigger(Not the email event). Remove that and you should be fine.

Anonymous said...

A really useful commentary on a common problem (especially virtual servers...) Worked a treat for me...
Thanks
D.

thomasesteve said...

Good morning,

I can't find EventID 2031.
I have only eventID 1001 and 1003.

Steps are missing ? May be a parameter into Eventviwer ?

Anonymous said...

Thank you Luk! Great article. I followed all the steps in it and everything worked fine.

Minor typo in the article (most read would be able figure this out by looking at the screen shots).

The last step to configure for this task is to set it to run after server restarts so open up the properties of the task and navigate to the Actions (should be Trigger) tab

Ajay More said...

Excellent Post ! Helped Me A lot

Thanks,
Ajay More
www.moreajays.com

Anonymous said...

Hi, I follow the steps, but in the step : With the data collector configured, the next step is to set the collector to start after server restarts so begin by navigating to Task Scheduler –> Task Scheduler Library –> Microsoft –> Windows –> PLA, right click on the collector task and select Properties:

doesnt appear the collector task that i created. What happens ?

Melani said...

Awesome Artical Really i have searching this type of valuable information From a lot of days i found satisfaction when Read your blog Thanks for giving this type blog and also please Read link bvba Woodstone which provide information server monitoring software & Network monitoring tools

Unknown said...

Your link was huge help. However I am still tick with an error message 0x80040211 which seems it is related to SMTP error. Because I am not getting Notification or Alert by email for low disk space task. While troubleshooting I found that I mistaken in typing my email address and then did correction. and refresh and start task. but not working. Please HELP!!!!! I could be hero in my office

Anonymous said...

Excellent and detailed explanation along with screen shots !!

Thanks a lot..

-Jitendra Mhalgi

Anonymous said...

One of the most clearly explained tech docs I've read, well done.

Anonymous said...

Excellent Post ! Helped Me A lot

Anonymous said...

In regards to the comment on the "May 7, 2014 at 9:06 PM" where the collector task doesn't appear. Go to the View menu and ensure that "Show Hidden Tasks" is selected.

Unknown said...

This isn't working for me. I followed the directions as specified on Windows 2008. I set the alert to notify when C: went below 4000mb. After dragging a file into C that dropped it down to 1000mb I still receive no alert. Everything is enabled and running. What can I do to test if something isn't configured properly?

Unknown said...

IS there a way here to limit the trigger to once every 24 hours. We had a instance where a devcie tried to write to a monitored disk and it kept emialing nonstop that it had dropped under the threshold

Wil said...

is there a way to email this alert from a windows server 2016? I tried to follow the procedure to email it the event but when i get to the action part and send an email and display a message have both been deprecated for 2016 server?

any thought on how to email this out