Submit a ticketCall us

Training ClassSign up for Network Performance Monitor (NPM) and Scalability instructor-led classes

Attend our instructor-led classes, provided by SolarWinds® Academy, to discuss the more advanced monitoring mechanisms available in NPM as well as how to tune your equipment to optimize its polling capabilities. NPM classes offered:
NPM Custom Monitoring and Polling
Orion Platform Scalability

Reserve your seat.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Emails alerts: LEM disks are near or at capacity

Emails alerts: LEM disks are near or at capacity

Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 1,499 Votes: 1 Revisions: 9


This article provides brief information and steps to resolve the following email alert:

This message indicates that one or more of your TriGeo appliance disks are near or at capacity.  This usually indicates a problem with your appliance.  If you receive this alert, please contact TriGeo Technical Support immediately and forward this message to


All LEM versions



The issue is caused when the SolarWinds Disk Warnings rule is enabled or another rule is using the Disk Warning email template.



1. Verify that your LEM partitions are not full

Connect to your CMC console via your hypervisor virtual console or SSH. See Use an SSH client to connect to your LEM Appliance.

The capacity will be displayed at the top of the initial screen in Advanced Configuration (hypervisor virtual console) or after logging in with SSH. The four partitions should have the following capcities:

  • LEM: <45%
  • OS: <45%
  • Logs/Data: ~90%
  • Temp: <=5%


If your disks are not at or near 100%, then this is not the source of email alerts.


2. Find the source event that triggered the email alert.

a. Open your web console and go to Explore > nDepth.

b. Search the time period of that email alert using the following condition:
  InternalRuleFired.EventInfo = *disk*

    You should see an InternalRuleFired event for each email message you received.

c. Highlight one of the InternalRuleFired events, and then click on the Explore drop down in the top-right corner and select Event.

This will open a window displaying three different events, designating the email it sent out.:

  • The source event
  • The InternalRuleFired event
  • An InternalCommand event

d. Highlight the top event, and then click the Event Details button in the top-left corner.

Examine the details of that event to find the source of the problem. Most likely, it is a Windows server with disk that is almost full or is having issues.


Last modified