Disk volumes
Every fixed volume: free space, fill trend, protection state and whether the filesystem is readable.
Topic id: disk_volumes.
Conditions
A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.
| Condition | Severity | How an episode ends |
|---|---|---|
BitLocker protection dropped (vol_bitlocker_dropped) | Notice | It closes when the state it watches is no longer set. |
data volume running out of space (vol_data_space_exhausting) | Warning to Error | It closes on a recovery rule written for this condition, which reads more than one measurement together. |
data volume space low (vol_data_space_low) | Display | It closes when any one of the several recovery conditions is met. |
volume filling fast (vol_fill_rate_high) | Display | It closes when the measurement falls back past its recovery point. |
OS volume running out of space (vol_os_space_exhausting) | Warning to Critical | It closes on a recovery rule written for this condition, which reads more than one measurement together. |
OS volume space low (vol_os_space_low) | Notice to Serious | It closes when any one of the several recovery conditions is met. |
volume unreadable (vol_unreadable) | Serious to Severe | It closes when the host reports one of the healthy states again. |
Example
Inventory (every 15 minutes)
2 volumes; "C" 103.1 GB free of 274.9 (38%), "D" 1.0 TB free of 2.2 (44%).
sparklogs.data.disk_volumes.volume: volume:3b1a9c1e-0000-0000-0000-100000000001
sparklogs.data.disk_volumes.bitlocker_protection: on
sparklogs.data.disk_volumes.filesystem: ntfs
sparklogs.data.disk_volumes.mount_state: mounted
sparklogs.data.disk_volumes.stale: false
sparklogs.data.disk_volumes.volume_role: os
sparklogs.data.disk_volumes.bitlocker_dropped: false
sparklogs.data.disk_volumes.volume_role_code: 1
sparklogs.data.disk_volumes.writeable: true
sparklogs.data.disk_volumes.free_pct: 37.5
sparklogs.data.disk_volumes.free_bytes: 103079215104
sparklogs.data.disk_volumes.mount_state_code: 1
SparkLogs: CONTEXT, Info, disk_volumes: INVENTORY: 2 volumes; "C" 103.1 GB free of 274.9 (38%), "D" 1.0 TB free of 2.2 (44%).
Selected conditions
vol_bitlocker_dropped
BitLocker protection is off or suspended on a fixed volume.
Impact: Data-at-rest protection may be reduced while the state persists.
Example
started; volume "C" bitlocker off for 120min (threshold 120min)
sparklogs.instance: volume:3b1a9c1e-0000-0000-0000-100000000001
sparklogs.data.disk_volumes.volume: volume:3b1a9c1e-0000-0000-0000-100000000001
sparklogs.data.disk_volumes.bitlocker_dropped: true
sparklogs.data.disk_volumes.bitlocker_off_age_min: 120.0
SparkLogs: vol_bitlocker_dropped, Notice, disk_volumes: vol_bitlocker_dropped: NOTABLE: started; volume "C" bitlocker off for 120min (threshold 120min)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | storage |
held | Trace to Fatal | storage |
recovered | Trace to Fatal | storage |
vol_data_space_exhausting
A data volume is projected to run out of space.
Impact: Capacity may be exhausted before normal maintenance can intervene.
Example
started; volume "D" volume role 2
sparklogs.instance: volume:3b1a9c1e-0000-0000-0000-100000000002
sparklogs.data.disk_volumes.volume: volume:3b1a9c1e-0000-0000-0000-100000000002
SparkLogs: vol_data_space_exhausting, Error, disk_volumes: vol_data_space_exhausting: NOTABLE: started; volume "D" volume role 2
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | storage |
held | Trace to Fatal | storage |
recovered | Trace to Fatal | storage |
vol_data_space_low
A fixed data volume is low on free space.
Impact: Applications or shares using that volume may fail writes if free space continues to fall.
Example
started; volume "D" free space 0.39% (threshold 10%)
sparklogs.instance: volume:3b1a9c1e-0000-0000-0000-100000000002
sparklogs.data.disk_volumes.volume: volume:3b1a9c1e-0000-0000-0000-100000000002
sparklogs.data.disk_volumes.volume_role_code: 2
sparklogs.data.disk_volumes.writeable: true
sparklogs.data.disk_volumes.free_pct: 0.39
sparklogs.data.disk_volumes.free_bytes: 8589934592
sparklogs.data.disk_volumes.vol_space_low_age_h: 0.0
SparkLogs: vol_data_space_low, Display, disk_volumes: vol_data_space_low: NOTABLE: started; volume "D" free space 0.39% (threshold 10%)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | storage |
held | Trace to Fatal | storage |
recovered | Trace to Fatal | storage |
vol_fill_rate_high
A volume has a high fill rate that current capacity is absorbing.
Impact: Capacity trend is worth watching, but no near-term full-volume condition is claimed.
Example
started; volume "D" fill rate 40.0 GB (threshold 1.0 GB)
sparklogs.instance: volume:3b1a9c1e-0000-0000-0000-100000000002
sparklogs.data.disk_volumes.volume: volume:3b1a9c1e-0000-0000-0000-100000000002
sparklogs.data.disk_volumes.fill_rate_bytes_per_h: 42949672961.12
SparkLogs: vol_fill_rate_high, Display, disk_volumes: vol_fill_rate_high: NOTABLE: started; volume "D" fill rate 40.0 GB (threshold 1.0 GB)
vol_os_space_exhausting
The OS volume is projected to run out of space.
Impact: The host may fail updates, logging, paging, or normal service operation if the OS volume fills.
Example
started; volume "C" volume role 1
sparklogs.instance: volume:3b1a9c1e-0000-0000-0000-100000000001
sparklogs.data.disk_volumes.volume: volume:3b1a9c1e-0000-0000-0000-100000000001
SparkLogs: vol_os_space_exhausting, Severe, disk_volumes: vol_os_space_exhausting: NOTABLE: started; volume "C" volume role 1
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | storage |
held | Trace to Fatal | storage |
recovered | Trace to Fatal | storage |
vol_os_space_low
The OS volume is low on free space.
Impact: Updates, logs, paging, or temporary files may be constrained if free space keeps falling.
Example
started; volume "C" free space 3.52% (threshold 15%)
sparklogs.instance: volume:3b1a9c1e-0000-0000-0000-100000000001
sparklogs.data.disk_volumes.volume: volume:3b1a9c1e-0000-0000-0000-100000000001
sparklogs.data.disk_volumes.volume_role_code: 1
sparklogs.data.disk_volumes.free_pct: 3.52
sparklogs.data.disk_volumes.free_bytes: 9663676416
sparklogs.data.disk_volumes.vol_space_low_age_h: 0.0
SparkLogs: vol_os_space_low, Notice, disk_volumes: vol_os_space_low: NOTABLE: started; volume "C" free space 3.52% (threshold 15%)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | storage |
held | Trace to Fatal | storage |
recovered | Trace to Fatal | storage |