Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: Is there a way to monitor disk space in LEM?

$
0
0

There seems to be two ways to interpret this question, so I'm going to tackle both.

 

First: Can I monitor the LEM's disk space?

 

Yes!  There's a couple ways to do this.  If you SSH into the LEM, under APPLIANCE you can run a DISKUSAGE command to get an immediate idea of the LEM's current disk usage.

 

Better yet, there is a template rule that is shipped with the LEM called "SolarWinds Disk Warnings."  This rule fires if any of the LEM's partitions gets over 90% full, and the default action is to send an e-mail.  Paired with another template rule, "Appliance Database Down," you can get alerts about something going wrong in the LEM before it's a big issue, and a timely call to support can get you fixed before anything is really broken.  Both these templates are tagged under "General Best Practice" in the Build --> Rules section of the GUI.

 

Second: Can I monitor disk space with the LEM?

 

It's important to understand that the LEM is event driven.  If the system can generate an event that a disk is full, the LEM Agent can capture that event, and a rule can be constructed to take some action, like send an e-mail.

 

In Windows, there is such an event.  It's ID 2013 in the System log, and it looks a lot like this in the LEM:

 

2014-10-06 12_53_27-SolarWinds Log and Event Manager Console.png

 

Important: There's no way for the LEM to set the threshold that fires this event on a disk.  That's a setting in the Windows Registry, and by default it fires when the disk reaches 90% full (or less than 10% free, depending on your point of view).  You can change this, but it'd be done in the registry on each system or through a GPO.

 

There's a template rule for this as well, "Windows Disk Nearly Full."  It's under General Best Practices as well.


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>