Monitoring free drive space with Windows Server 2008 R2 and Performance Monitor

Problem

You would like to monitor free drive space on a server with the native features of Windows Server 2008 R2 without having to purchase monitoring software such as SolarWinds, SCOM, etc.

Solution

I’ve found myself in plenty of situations where I need to set up a quick way of monitoring free drive space on various versions of Windows Server because I either don’t have access to the monitoring application that the company uses, lack of licenses for the monitoring application to add the new host or the company simply does not have monitoring.  When this situation comes across my deployments, I simply use the native Performance Monitor feature of Windows Server 2008 R2 to monitor and send an email alert to email addresses.  Note that this feature is also available in Windows Server 2003 but this blog post will just cover 2008.

Note that Microsoft has various articles that covers setting this up so I’ll include some of the links here:

HOW TO: Configure a Low Disk Space Alert by Using the Performance Logs and Alerts Feature in Windows Server 2003
p://support.microsoft.com/kb/324796

Configure Windows Server 2008 to Notify you when Certain Events Occur
http://technet.microsoft.com/en-us/magazine/ff458614.aspx

Create a Data Collector Set to Monitor Performance Counters
http://technet.microsoft.com/en-us/library/cc722414.aspx

The first step in setting the monitoring up is to open Performance Monitor and create an alert so begin by opening up the application in Administrative Tools then navigate to Data Collector Sets –> User Defined:

Right click on the User Defined node and select New –> Data Collector Set:

In the Create new Data Collector Set, type in a name for this collector, select Create manually (Advanced) and click Next:

Select Performance Counter Alert and click Next:

Click on the Add… button:

Navigate to the Logical Disk selection:

You’ll find various counters in this section and whether you prefer to use % Free Space or Free Megabytes will be based on the type of application and drive size you’ll be monitoring.  I personally prefer Free Megabytes because the drive I’m monitoring is a 1TB drive and setting up a hard threshold based on a constant value seems to make more sense:

Note the logical drives are listed under the Instances of selected object so select the ones you’d like to monitor:

Clicking on OK will bring you back to the Create new Data Collector Set window.  Proceed with setting a threshold:

Notice how I’ve set the Alert when to Below and the Limit to 2048.  This simply means I’m setting a threshold to 2GB for each of the drives. Proceed with clicking the Next button when you’ve configured all of the drives’ thresholds:

Unless you have restrictions on the service account where the default is SYSTEM, proceed by click on Finish:

It’s not necessary to verify the Run As account but I like to double check just to be sure so right click on the new Data Collector Set and select Properties:

Under the General tab, ensure that Run As is the account you wanted to run this Data Collector Set as:

With the Data Collector Set account verified, notice how a new collector is now set up:

Continue by right clicking on the data collector and choose properties:

Navigate to the Alert Action tab and select the Log an entry in the application event log:

With the data collector configured, the next step is to set the collector to start after server restarts so begin by navigating to Task Scheduler –> Task Scheduler Library –> Microsoft –> Windows –> PLA, right click on the collector task and select Properties:

Navigate to the Triggers tab and click on the New button:

Click on the New button and select At startup for Begin the task and ensure that Enabled is selected:

You should now see a new trigger listed, proceed to save the trigger by clicking on the OK button:

Start the data collector set by right clicking on the object and selecting Start:

Unlike Windows Server 2003, the data collector DOES NOT write logs to the application logs but rather the following log:

Applications and Services Logs/Microsoft/Windows/Diagnosis-PLA/Operational

Note that I changed the threshold from 2048 to 20480 so that I could trigger the alert:

Now that we’ve generated an information event with the ID 2031 in the logs, we can proceed with setting up a task to send an email to an address.  Proceed by right clicking on the event and select Attach Task To This Event…:

Give the task a meaningful name and proceed by clicking the Next button:

There isn’t much to change in the When an Event Is Logged so continue by clicking on the Next button:

In the Action step, change the action from Start a program to Send an e-mail:

Fill in the appropriate fields (make sure this server can relay mail off of your SMTP server:

Complete the wizard:

What’s important to note is that the task we created is automatically assigned the account you’re logged in as to run the service and is set to run only when the user is logged on which probably isn’t what most of us want to navigate to Task Scheduler –> Task Scheduler Library –> Event Viewer Tasks:

Right click on the e-mail notification event that was created and select Properties:

From within the properties window under the General tab, click on Change User or Group…:

Change the account to service account (local or domain) that is a local administrator on the server and is allowed to run as a service (Log on as batch job permissions):

In this example, I created a service account named svc_monitoring:

Save the configuration by click on the OK button.

The last step to configure for this task is to set it to run after server restarts so open up the properties of the task and navigate to the Actions tab:

Click on the New button and select At startup for Begin the task and ensure that Enabled is selected:

Proceed with saving the settings by clicking OK:

Trigger an event to test and you should see an email similar to the following:

I hope this helps anyone looking for a quick and dirty way to monitor free drive space on their servers.