Alert on low disk space by using both disk space % and disk space bytes

[RishiSuthar]

Hi,

We are looking to monitor low disk space with the following setup:
alert if space <= 97% AND space <300 gig

Is this something that can be achieved within the alerting query?

[Maheedhar_T · Accepted solution]

You can use new "Davis Anomaly Detector" app for this.
What you need is a query which checks both of the conditions.
In data explorer it looks something like this

and when you click on open with and open that with a notebook it gets converted to DQL and looks something like the below.

timeseries { free = avg(dt.host.disk.free), avail = avg(dt.host.disk.avail) }, by: { dt.entity.host }, filter: { in(dt.entity.host, classicEntitySelector("type(host),fromRelationship.isInstanceOf(type(HOST_GROUP),entityName.equals(\"XXXXXX\"))")) }
| sort arrayAvg(free) desc
| fieldsAdd entityName(dt.entity.host)
| limit 20

Then again when you click open with you find something like this.

click on Davis anomaly detector and you will be redirected to the Anomaly detector Application where you can create the event.
Then you can see your query in the query section of the config and in the Customise parameters section this is what you have to give.

Here the query gives disk available % first and disk available (bytes) as second output hence we configure something like this.
3,322,122,547,200
Don't get confused with so many "," s.
Split it as 
(3),(322,122,547,200) the first part is disk available is 3% and the second part is disk available is 322,122,547,200 bytes.
and we have set the alert to be triggered if the metric is below which means alert would be triggered if both of the conditions you mentioned above are met.

Hope this answers your query.

Regards,
@Maheedhar_T 

[Maheedhar_T]

One thing I forgot to mention is that you have to convert your 300 gig to bytes to add it as threshold as the metric we are using above gives the disk available in bytes.

Also,
This is the only way I see ahead as I was not able to replicate the same using classic metric events.

Hope you're on Grail....
Happy querying @RishiSuthar