Monitor Disk space via SNMP

duncan.caldwell · Post by **duncan.caldwell** » Mon Sep 17, 2012 5:30 pm

If you are not able to connect to a server using windows protocols or to install an agent on a server you can still monitor free disk space using SNMP.

This is great where you have limited access to a server because of firewall rules. Using only SNMP (port 161) you can still get the details about the amount of free disk space for drives on a server.

When using this method it is helpful to use a SNMP tool to browse the remote device.

This uses the hrStorageTable .1.3.6.1.2.1.25.2.3

This table contains the details about disk and memory use on a windows device.

The table is broken down in to these components

hrStorageIndex .1.3.6.1.2.1.25.2.3.1.1 - A list of all the devices listed e.g. .1.3.6.1.2.1.25.2.3.1.1.1 wil return 1, .1.3.6.1.2.1.25.2.3.1.1.2 will return 2 etc up to the number of storage devices.
hrStorageType .1.3.6.1.2.1.25.2.3.1.2 - A list of the storage types (information not in my MIB)
hrStorageDescription .1.3.6.1.2.1.25.2.3.1.3 - A list of text description of the devices e.g. .1.3.6.1.2.1.25.2.3.1.3.1 returns "A:\", .1.3.6.1.2.1.25.2.3.1.3.2 returns "C:\ Label: Serial Number xxxxxxx"
hrStorageAllocationUnits .1.3.6.1.2.1.25.2.3.1.4 - A list of the number of bytes per unit allocated to the device e.g. .1.3.6.1.2.1.25.2.3.1.4.2 returns 4096.
hrStorageSize .1.3.6.1.2.1.25.2.3.1.5 - A list of the capacity of the device in storage allocation units
hrStorageUsed .1.3.6.1.2.1.25.2.3.1.6 - A list of the number of storage allocation units used
hrStorageAlocationFailures .1.3.6.1.2.1.25.2.3.1.7 - Not sure on this item, maybe someone can supply details on this

Each of these OID represent a list of devices. Starting with an index of 1 to the number of storage devices in the system being queried.
The actual index value will vary depending on the configuration of the system being queried. e.g a system with a floppy drive, 1 hard drive, and a CD drive will have 5 items in each list, one for each drive and one for virtual memory and one for physical memory.
If you add more drives then you will increase the number of items in the index.

To illustrate this lets look at hrStorageDescription .1.3.6.1.2.1.25.2.3.1.3

In my system I have
hrStorageDescription .1.3.6.1.2.1.25.2.3.1.3.1 = A:\
hrStorageDescription .1.3.6.1.2.1.25.2.3.1.3.2 = C:\
hrStorageDescription .1.3.6.1.2.1.25.2.3.1.3.3 = D:\
hrStorageDescription .1.3.6.1.2.1.25.2.3.1.3.4 = Virtual Memory
hrStorageDescription .1.3.6.1.2.1.25.2.3.1.3.5 = Physical Memory

Using this information and the ability of HostMonitor to perform calculations I can generate the % of disk space used by the C:\ drive

In Host Monitor set up a SNMP Get test for the system. Entering all the correct values for Host, SNMP profile etc
For the field "Alert when OID" enter
result=([1.3.6.1.2.1.25.2.3.1.6.2]*[1.3.6.1.2.1.25.2.3.1.4.2]*100) div ([1.3.6.1.2.1.25.2.3.1.5.2]*[1.3.6.1.2.1.25.2.3.1.4.2])
Then you can specify "is > than" and a value for the percentage used e.g. 80 for 80%

This test will query the server gather the OIDs listed above and calculate the amount of space used as a percentage.

So what does all that mean in the OID field.
1.3.6.1.2.1.25.2.3.1.6.2 : the .6.2 on the end, means get the number of storage units used for the 2nd device
1.3.6.1.2.1.25.2.3.1.4.2 : the .4.2 on the end, means get the size of the allocation units for the 2nd device
multiply these two number to get the total bytes used on the device

1.3.6.1.2.1.25.2.3.1.5.2 : the .5.2 on the end, means get the total capacity in allocation units for the 2nd device
1.3.6.1.2.1.25.2.3.1.4.2 : the .4.2 on the end, means get the size of the allocation units for the 2nd device
multiply these two numbers together to get the total capacity of the device in bytes

Multiply the first number by 100 then divide by the second number and return an integer value.

This is then passed as the result.

One thing I have found is that Windows can be slow to respond to these SNMP queries about disk space. I found using the default values, I was getting a lot of "Unkown" results. By increasing the timeout and retries to 10000 and 3 I am not getting any more "Unknown" results. You may find your system responds quicker than mine and reduce these vaules.

I hope you find this information useful and please feel free to comment of improve on the above.

KS-Soft · Post by **KS-Soft** » Tue Sep 18, 2012 3:12 pm

Thank you.
BTW as we know these counters works on every Windows starting from Windows 2000.

Regards
Alex

mrw · Post by **mrw** » Tue Jan 29, 2013 6:05 am

Would it be possible to create a single test that gets free physical memory using these OIDs that work on all servers without the need to probe every server for the correct index value? It would be nice to be able to copy this test without changing it every time.

This test would ofcourse test every index and search for the string "Physical Memory" and set the oids to the corresponding index.

Currently I use the WMI script(from these forums) for this but for me it timeouts too often, so it´s more annoying than useful. SNMP works better for me.

KS-Soft · Post by **KS-Soft** » Tue Jan 29, 2013 8:14 am

This is no such option.
May be we can implement new test for memory checks over SNMP

Regards
Alex

mrw · Post by **mrw** » Tue Jan 29, 2013 8:26 am

That would be great! And ofcourse the same method could be used for checking free disk space on selected partitions.
Probably with an OS selection similar to the "CPU Usage" test?

So chopchop! Start coding and implement this feature ASAP instead of answering stupid forum posts! ;D

Regards
//Andreas..

KS-Soft · Post by **KS-Soft** » Tue Jan 29, 2013 8:47 am

Existing Drive Free Space test does not work??

Start coding and implement this feature ASAP instead of answering stupid forum posts!

Forum posts? Its nothing comparing to 100 emails every day.

Regards
Alex

mrw · Post by **mrw** » Tue Jan 29, 2013 8:59 am

Well, the Drive Free Space Test works fine. But I want to have it reporting Disk Usage in % instead of free space to match the rest of the tests.
So I used a WMI script instead

But if you can update your test to have the option of displaying either free space or used space, that would be excellent!

KS-Soft · Post by **KS-Soft** » Tue Jan 29, 2013 10:24 am

This option for Drive Free Space was implemented last year.

Also there is UNC test method that can check free space and support this option for about 8 or 10 years (note: this test will not be able to check remote drives unless you share recource or use RMA).

Regards
Alex

mrw · Post by **mrw** » Wed Jan 30, 2013 1:53 am

I know about the UNC method but I preferred the WMI script.

But how do I change the "Drive Free Space" test to be "Drive Usage"?
I can´t find that option? I´m prepared for an answer that states I´m stupid for missing that..

KS-Soft · Post by **KS-Soft** » Wed Jan 30, 2013 7:39 am

Drive Usage? There is no such test method.
And its impossible to change one test method with another.

Regards
Alex

mrw · Post by **mrw** » Wed Jan 30, 2013 7:44 am

Um, ok. Then I guess I misunderstood when you said "This option for Drive Free Space was implemented last year."
I assumed you meant reversing the result of Drive Free Space to show Used instead.

So I guess I´ll stick with the WMI script for this until you add the "Memory Usage" test.

Regards,
//Andreas..

KS-Soft · Post by **KS-Soft** » Wed Jan 30, 2013 7:54 am

Now I am confused.
Do you need to check Hard Drive free space or Physical Memory (RAM) ?

Regards
Alex

mrw · Post by **mrw** » Wed Jan 30, 2013 8:11 am

Hehe, same here

My original question was to check "Memory Usage" using SNMP on Windows. But since the method(the topmost post) to do that is exactly the same way to check for "Disk Usage" on selected partitions I brought that up when you said you might create this test.

So if you create such a test in a future release then I have no further questions regarding this, since I assume that test would work for both memory and disks.

Thanks,
//Andreas..