Logical Disk Free Space Monitor - Slow to detect low free space

Question

We are using the built in two trigger (MB and %) logical disk free space monitor in SCOM 2012 R2. We have setup overrides for MB warning and critical for both system and non-system drives and for a group containing disks we do not want monitored. The monitor
actually works fine, triggering an alert when both the MB and % free criteria are met. The problem is that it takes almost an hour for the initial alert to fire. After the initial alert, if I further fill the disk to push it from warning to critical, the alert
changes within the specifiec interval, which we have left at 15 minutes. The alert also clears using the 15 minute interval.
Has anyone else seen this behavior with this monitor? A disk monitor that takes an hour to fire is not going to be very useful.

Answer 1

I wanted to see for myself if there was anything else that I might be missing, so I opened up the Windows 2008 Logical Disk Free Space monitor XML and noticed that there is a NumSamples configuration that is set to 4. So, if the interval is 15 minutes, the
disk would have to exceed both threshold types for 4 consecutive intervals in order to change state and generate alert. This would be a minimum of 1 hour before an alert is raised with the default 15 minutes interval.
Unfortunately, NumSamples is not overrideable in the monitor type, which is too bad... The only way to get an alert sooner than one hour is to override interval. For example, if you want an alert within 20 minutes, override interval to 300 seconds (5 minutes).
Here is the code - see for yourself:
<UnitMonitor ID="Microsoft.Windows.Server.2008.LogicalDisk.FreeSpace" Accessibility="Public" Enabled="true" Target="Server2008!Microsoft.Windows.Server.2008.LogicalDisk" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Microsoft.Windows.Server.2008.FreeSpace.Monitortype" ConfirmDelivery="true">
<Category>Custom</Category>
<AlertSettings AlertMessage="Microsoft.Windows.Server.2008.LogicalDisk.FreeSpace.AlertMessage">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$</AlertParameter1>
<AlertParameter2>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter2>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UnderWarningThresholds" MonitorTypeStateID="UnderWarningThresholds" HealthState="Success" />
<OperationalState ID="OverWarningUnderErrorThresholds" MonitorTypeStateID="OverWarningUnderErrorThresholds" HealthState="Warning" />
<OperationalState ID="OverErrorThresholds" MonitorTypeStateID="OverErrorThresholds" HealthState="Error" />
</OperationalStates>
<Configuration>
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<DiskLabel>$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$</DiskLabel>
<IntervalSeconds>900</IntervalSeconds>
<SystemDriveWarningMBytesThreshold>500</SystemDriveWarningMBytesThreshold>
<SystemDriveWarningPercentThreshold>10</SystemDriveWarningPercentThreshold>
<SystemDriveErrorMBytesThreshold>300</SystemDriveErrorMBytesThreshold>
<SystemDriveErrorPercentThreshold>5</SystemDriveErrorPercentThreshold>
<NonSystemDriveWarningMBytesThreshold>2000</NonSystemDriveWarningMBytesThreshold>
<NonSystemDriveWarningPercentThreshold>10</NonSystemDriveWarningPercentThreshold>
<NonSystemDriveErrorMBytesThreshold>1000</NonSystemDriveErrorMBytesThreshold>
<NonSystemDriveErrorPercentThreshold>5</NonSystemDriveErrorPercentThreshold>
<NumSamples>4</NumSamples>
</Configuration>
</UnitMonitor>
This proves 2 things:
1. Your testing proved that the monitor is working as designed - you got an alert in about an hour
2. This is a bad design at best, or a bug if you wish, as NumSamples should not be a hidden configuration - it should be exposed in override parameters in the console.
This should be fixed by Microsoft.
Jonathan Almquist | SCOMskills, LLC (http://scomskills.com)