Submit a ticketCall us

Welcome to the NEW Success Center. Search all resources (documentation, videos, training, knowledge base articles) or browse resources by product. If you are unable to find what you are looking for, please contact us at customersuccess@solarwinds.com

 

 

 

 

Home > Success Center > Log & Event Manager (LEM) > Emails alerts: LEM disks are near or at capacity

Emails alerts: LEM disks are near or at capacity

Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 1,047 Votes: 1 Revisions: 9

Overview

This article provides brief information and steps to resolve the following email alert:

This message indicates that one or more of your TriGeo appliance disks are near or at capacity.  This usually indicates a problem with your appliance.  If you receive this alert, please contact TriGeo Technical Support immediately and forward this message to support@trigeo.com.

Environment

All LEM versions

 

Cause 

The issue is caused when the SolarWinds Disk Warnings rule is enabled or another rule is using the Disk Warning email template.

 

Resolution

1. Verify that your LEM partitions are not full

Connect to your CMC console via your hypervisor virtual console or SSH. See Use an SSH client to connect to your LEM Appliance.

The capacity will be displayed at the top of the initial screen in Advanced Configuration (hypervisor virtual console) or after logging in with SSH. The four partitions should have the following capcities:

  • LEM: <45%
  • OS: <45%
  • Logs/Data: ~90%
  • Temp: <=5%

 

If your disks are not at or near 100%, then this is not the source of email alerts.

 

2. Find the source event that triggered the email alert.

a. Open your web console and go to Explore > nDepth.

b. Search the time period of that email alert using the following condition:
  InternalRuleFired.EventInfo = *disk*

    You should see an InternalRuleFired event for each email message you received.

c. Highlight one of the InternalRuleFired events, and then click on the Explore drop down in the top-right corner and select Event.

This will open a window displaying three different events, designating the email it sent out.:

  • The source event
  • The InternalRuleFired event
  • An InternalCommand event

d. Highlight the top event, and then click the Event Details button in the top-left corner.

Examine the details of that event to find the source of the problem. Most likely, it is a Windows server with disk that is almost full or is having issues.

 

Last modified
19:59, 22 Jun 2016

Tags

Classifications

Public