Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Log & Event Manager (LEM) > Emails alerts: LEM disks are near or at capacity

Emails alerts: LEM disks are near or at capacity

Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 44 Votes: 1 Revisions: 9


This article provides brief information and steps to resolve the following email alert:

This message indicates that one or more of your TriGeo appliance disks are near or at capacity.  This usually indicates a problem with your appliance.  If you receive this alert, please contact TriGeo Technical Support immediately and forward this message to


All LEM versions



The issue is caused when the SolarWinds Disk Warnings rule is enabled or another rule is using the Disk Warning email template.



1. Verify that your LEM partitions are not full

Connect to your CMC console via your hypervisor virtual console or SSH. See Use an SSH client to connect to your LEM Appliance.

The capacity will be displayed at the top of the initial screen in Advanced Configuration (hypervisor virtual console) or after logging in with SSH. The four partitions should have the following capcities:

  • LEM: <45%
  • OS: <45%
  • Logs/Data: ~90%
  • Temp: <=5%


If your disks are not at or near 100%, then this is not the source of email alerts.


2. Find the source event that triggered the email alert.

a. Open your web console and go to Explore > nDepth.

b. Search the time period of that email alert using the following condition:
  InternalRuleFired.EventInfo = *disk*

    You should see an InternalRuleFired event for each email message you received.

c. Highlight one of the InternalRuleFired events, and then click on the Explore drop down in the top-right corner and select Event.

This will open a window displaying three different events, designating the email it sent out.:

  • The source event
  • The InternalRuleFired event
  • An InternalCommand event

d. Highlight the top event, and then click the Event Details button in the top-left corner.

Examine the details of that event to find the source of the problem. Most likely, it is a Windows server with disk that is almost full or is having issues.


Last modified
19:59, 22 Jun 2016