Disk space specific to few servers and directories

[sundarv1]

We would like to alert if the disk space is greater than 80% for few set of servers and specific directories only?

For e.g 

Server A - there are 10 directories. For few directories we want to alert if disk space is more than 80 to 89%

and few we want to alert if disk space is more than 90% only

How do we configure that?

[erh_inetum]

Hi @sundarv1 ,

Going to Settings / Anomaly detection / Disk in hosts you want to configure the alerts:

Click on the disk or disk\path 

and configure the thresholds:

Hope it helps.

Regards,

Elena.

[sundarv1]

Thanks. How do we do the same via metric event?

[erh_inetum]

Welcome.

You can configure a metric event defining the metric selector with a metric like

builtin:host.disk.usedPct:filter(and(or(in("dt.entity.disk",entitySelector("type(disk),entityName.in(~"path~")"))),or(in("dt.entity.host",entitySelector("type(host),entityName.equals(~"host~")"))))):splitBy("dt.entity.host","dt.entity.disk")

and the thresholds.

Regards,

Elena.

[sundarv1]

Thanks. How do we reuse the above query to generate alert only if it is between 80 to 89% . Where do i can specify the threshold in above filter condition.

[erh_inetum]

I'm not sure to be honest if it's possible to do that because I think you can only configure a threshold using one value. Defining a threshold between two values could be a good product idea to create.

I can think of creating the same metric event twice with different names. In once defining the threshold above and the other one below. But I'm not sure if it'll work. You can test it.

Regards,

Elena.

[sundarv1]

Thanks., Where do i specify the threshold in the above metric filter?.

[erh_inetum]

In the same place that you configure the metric event.
Here you have a couple of links with documentation about how to create a metric event:

https://docs.dynatrace.com/docs/platform/davis-ai/anomaly-detection/metric-events

https://www.dynatrace.com/news/blog/metric-events-set-up-anomaly-detection-based-on-your-business-ne...

Regards,
Elena.

[sundarv1]

builtin:host.disk.usedPct:filter(and(or(in("dt.entity.disk",entitySelector("type(disk),entityName.in(~"path~")"))),or(in("dt.entity.host",entitySelector("type(host),entityName.equals(~"host~")"))))):splitBy("dt.entity.host","dt.entity.disk")

Thanks. How do add multiple hosts in the above query?,

[erh_inetum]

Hi @sundarv1 ,

You have to add this piece of code

,in("dt.entity.host",entitySelector("type(host),entityName.equals(~"host~")"))

as many times as hosts want to add.

Ex: 

builtin:host.disk.usedPct:filter(and(or(in("dt.entity.disk",entitySelector("type(disk),entityName.in(~"path~")"))),or(in("dt.entity.host",entitySelector("type(host),entityName.equals(~"host~")")),in("dt.entity.host",entitySelector("type(host),entityName.equals(~"host~")"))))):splitBy("dt.entity.host","dt.entity.disk")

Regards,

Elena.

[sundarv1]

builtin:host.disk.free:filter(and(or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/obidata~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/opt~")")))))
:splitBy("dt.entity.host","dt.entity.disk"):avg:sort(value(avg,descending)) - This is not working.

I tried.  When i do separately data is coming and when i put in single query output is empty

[sundarv1]

builtin:host.disk.free:filter(and(or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"D:\~")")),
in("dt.entity.host",entitySelector("type(host),entityName.equals(~"AUSZVRCUW338.rcuad.local~")"))),
in("dt.entity.host",entitySelector("type(host),entityName.equals(~"AUSZVRCUW337.rcuad.local~")"))))

I am getting output only one server and though D:\ is present in both

[erh_inetum]

Hi @sundarv1 ,

Have you check the timeframe in which you're getting the data?

Regards,

Elena.

[sundarv1]

yes i checked for last 90 days and only server 337 is coming. 338 is not coming

[erh_inetum · Accepted solution]

Try this:

builtin:host.disk.free:filter
(and
(or
(in("dt.entity.host",entitySelector("type(host),entityName.equals(~"AUSZVRCUW338.rcuad.local~")")),
in("dt.entity.host",entitySelector("type(host),entityName.equals(~"AUSZVRCUW337.rcuad.local~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"D:\~")")))))

[sundarv1]

Thank you. one last thing. with above query and we want to get alert if it disk space is more than 80%. Does the attached screenshot looks good?.

[erh_inetum]

Welcome @sundarv1 🙂

Yes, but don't forget the alert condition:

Regards,

Elena.

[sundarv1]

Thanks. I did try it and see it is not working. i modifed to 50% as we have some disks avalaible less than 50% and but it is not working. How to make sure this is working before we enable the metric

[erh_inetum]

Welcome @sundarv1 

In Alert Preview section you can see if the configured threshold will reach the in the last day, 3 days or 7 days depending on the dimension (host and disk) selected.
You can play with this threshold in this section to preview if the alarm will trigger according the set threshold:

Hope it helps.