The Benefits of Logging Disk Space Warnings or Errors

Disk capacity requirements will vary depending on the purpose of the associated system and applications utilizing the storage space. When there is no longer any free disk space available, the effect can be minor to border-line catastrophic. And a catastrophic failure usually means that no remote access can be made to free up storage space and any resident applications will most likely be negatively impacted the inability to write disk. 

These types of situations can be caused by a number of circumstances and should be monitored from an operations, audit and security perspective. Most environments will be a mixture of operating systems and devices and some may not provide this type of monitoring “out of the box,” requiring a third-party add on or a scripted process.

With Windows distributions (and some Linux), free disk space can be monitored and logged for subsequent alerting. Below are references to what needs to be configured to monitor disk free space.

Windows:

Open the registry, navigate to the following key and edit to define the specific percentage (DWORD value) of free disk space available before the OS writes to the SYSTEM Event log:

HKLMSYSTEMCurrentControlSetServicesLanmanServerParametersDiskSpaceThreshold

The default value (even if this parameter isn’t defined) is 10%.

NOTE:  This will only be logged once until free space is made available and will log again if it drops back below the defined threshold.

Windows 2003 can also be set to log to the SYSTEM Event log when the percentage of free disk space falls below a defined threshold value (in MBs).

HKLMSYSTEMCurrentControlSetServicesLanmanServerParametersLowDiskSpaceMinimum

The default value is 400 MB. This will log frequently until free space is made available and above the defined threshold.

Linux:

Depending on the various make/distributions, this is typically done via a scheduled script that will perform this validation and if need be log to syslog or send a mail message to an appropriate recipient.

The process to perform this is typically a scheduled CRON job that executes a Perl script to assess the free space of the mounted disks. The script is usually named “diskcheck” and is configured by editing the file located here: /etc/diskcheck.conf.

Regardless of what operating system or device, if it’s possible to monitor the amount of free disk space and log the event, it can potentially remove the need for time-consuming recovery efforts. This frees up IT and support resources and ensures a high-percentage of uptime and system/application availability.