Monitoring Abnormal (sudden) Disk Usage with SCOM

A customer recently asked me for a solution to monitor an abnormal growth in usage of a volume or disk. SCOM doesn’t have a native monitor for that. Enters PowerShell and authoring!

First I wrote the script, that essentially accepts a drive letter, a threshold (in MBytes) and a debug flag to log events in event viewer.

The script will use Get-WmiObject Win32_LogicalDisk -ComputerName . -Filter “DeviceID=’$driveletter'” | Select-Object Size,FreeSpace to retrieve the status of the drive.

I will then compare the previous Freespace usage (using temp file to compare) and if the growth is larger than the threshold, the rule is triggered.

I have also included a rule to collect event 666 (debug) if enabled.

The Management Pack has basically two rules:

   
Fehse.Extended.Disk.Monitoring.DiskGrowthPercentageRule 5% growth on a 15 minutes interval

Fehse.Extended.Disk.Monitoring.DiskGrowthRule

5Gb of growth on a 15 minutes interval

Both rules are disabled by default and need to be overridden for each computer you want to monitor (or disk in this case).

Debug is enabled by default, so you can expect events 666 in the Operations Manager log on every computer running the scripts. They will look like this:

image

MP can be found here.

 

Hope this helps!