Submit a ticketCall us

WebinarUpcoming Webinar: Know What’s Changed – with NEW Server Configuration Monitor

Change management in IT is critical. But, even with a good change management process, changes are too often not correctly tracked, if at all. The configuration of your servers and applications is a key factor in their performance, availability, and security. Many incidents can be tracked back to an authorized (and sometimes unauthorized) configuration change, whether to a system file, configuration file, or Windows® Registry entry. Join SolarWinds VP of product management Brandon Shopp to discover how the new SolarWinds® Server Configuration Monitor is designed to help you.

Register now.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Emails alerts: LEM disks are near or at capacity

Emails alerts: LEM disks are near or at capacity

Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 1,412 Votes: 1 Revisions: 9


This article provides brief information and steps to resolve the following email alert:

This message indicates that one or more of your TriGeo appliance disks are near or at capacity.  This usually indicates a problem with your appliance.  If you receive this alert, please contact TriGeo Technical Support immediately and forward this message to


All LEM versions



The issue is caused when the SolarWinds Disk Warnings rule is enabled or another rule is using the Disk Warning email template.



1. Verify that your LEM partitions are not full

Connect to your CMC console via your hypervisor virtual console or SSH. See Use an SSH client to connect to your LEM Appliance.

The capacity will be displayed at the top of the initial screen in Advanced Configuration (hypervisor virtual console) or after logging in with SSH. The four partitions should have the following capcities:

  • LEM: <45%
  • OS: <45%
  • Logs/Data: ~90%
  • Temp: <=5%


If your disks are not at or near 100%, then this is not the source of email alerts.


2. Find the source event that triggered the email alert.

a. Open your web console and go to Explore > nDepth.

b. Search the time period of that email alert using the following condition:
  InternalRuleFired.EventInfo = *disk*

    You should see an InternalRuleFired event for each email message you received.

c. Highlight one of the InternalRuleFired events, and then click on the Explore drop down in the top-right corner and select Event.

This will open a window displaying three different events, designating the email it sent out.:

  • The source event
  • The InternalRuleFired event
  • An InternalCommand event

d. Highlight the top event, and then click the Event Details button in the top-left corner.

Examine the details of that event to find the source of the problem. Most likely, it is a Windows server with disk that is almost full or is having issues.


Last modified