Security Compliance

Monitor SEM Windows disk space

This article provides steps to monitor the disk space on nodes with SEM. When disk space left is lower than required, a rule is triggered that sends an email notification.

First published date

10/17/2018 2:10 PM

Last published date

9/16/2022 2:34 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).

This article provides steps to monitor the disk space on nodes. When the disk space left is lower than required, a rule is triggered that sends an email notification.

 

Note: Windows hard disk or new capacity is based on Windows provider SID 2013.

Per Microsoft by default, these thresholds are 200MB, 80MB, and 50MB respectively.

Use this rule to monitor and edit to include the Send email action. This sends email alerts in the event that a Windows machine hard disk is at or near capacity.

Product section

Security Event Manager

Resolution

In the HTML5 SEM Events Console (SEM 6.7 and later):

  1. In the SEM Events Console, click the Rules tab.
  2. On the Rules toolbar, click Create rule from template.
  3. In the search box, enter Windows Disk Nearly Full . 
  4. Select the Windows Disk Nearly Full  rule template, click Next, and then click Next again.
  5. Under Actions, click Add New Actions.
  6. In the Add new action search box, type email.
  7. Select Send Email Message, and then click Next.
  8. Select or enter a recipient, and then click Add.
  9. Review your rule details, and then click Create.
In the SEM Flash Console:
  1. Log in to the SEM Web Console.
  2. Go to Build > Rules.
  3. Windows Disk Nearly Full in the Rules template. 
  4. Click the gear icon, and clone the rule so it shows in the list of the active rules.
  5. Edit the rule to include the action to be activated when the rule is triggered.