Monitor - false positive?

[kc2kth]

Regarding monitor "ESX Host Datastore is low on Free Disk Space in KB", I am receiving critical alerts for this monitor on multiple hosts. For reference, the configuration of this monitor is:

- <Configuration>
<ObjectName>VMHost-Datastore</ObjectName>
<CounterName>diskFree</CounterName>
<InstanceName>$Data/Property[@Name='mountPoint']$</InstanceName>
<Value>$Data/Property[@Name='diskFree']$</Value>
<Threshold1>256000</Threshold1>
<Threshold2>512000</Threshold2>
<EntityIdTarget>$Target/Property[Type="nworks.VMware.VEM.VMHOSTDATASTORE"]/id$</EntityIdTarget>
<ClassName>DATASTORESTATS</ClassName>
<NumSamples>1</NumSamples>
</Configuration>

Looking at my State Change Events tab I see that this server went to WARN and then CRIT yesterday after I added these datastores to the "high priority" datastore group created by the nworks Quick Start MP, which was installed following installation of the nworks 5.6 MP. The Average Sample Value on the state change event is 56051712, or roughly 53GB. This matches what I see for datastore free space in vcenter.

The Knowledge for this monitor indicates it should alert at two levels - 200MB free and again at 100MB remaining, presumably "WARN" and "CRIT" respectively. This is not in line with the configuration of the monitor I posted above, which appears to alert at 512MB and 256MB.

Clearly my read values of ~53GB free are far above any of those alert levels - 200/100 or 512/256. Is this a false positive or am I misreading this alert somehow?

Thanks in advance!

[kc2kth]

The alerts I was seeing and described above were due to the nworks "quick start" MP that I added to our environment (in addition to the nworks 5.6 MP). I started looking at this again this morning and realized the quick start management pack has a few overrides that I must have missed when I was looking at this before the holiday – although I could swear I checked those out previously. Specifically datastores classified as “tier 1” (the quick start MP uses groups to classify various objects, including datastores) have overrides set to adjust this monitor. WARN state is set when free space is < 125GB, CRIT state is set when free space is < 100GB. This perfectly explains what we were seeing.

In this case I actually disabled the KB free space monitor for tier 1 storage and instead re-enabled the % free monitor. I configured that monitor to match how we were alerting already in vSphere – WARN at 85%, CRIT at 90%. While I don’t generally like or recommend using % free monitors for disks, in our case this will work better at least as long as we are trying to duplicate what is already happening in vSphere.

[Alec King]

Hi John,

Thanks for the feedback! And my apologies for not replying to your earlier post, but we have some issue with our forum where email notifications are not sent for new posts

You're quite correct with your analysis of the Datastore monitor - and the KB article does list the thresholds of 200MB and 100MB, as those are the best practice thresholds from VMware beyond which you can have serious issues (datastore and VM corruption etc)
In order to avoid the chance of such corruption, the out-of-box thresholds in the nworks MP are a little higher, as you saw - 512MB and 256MB - to give you some time to take action.

The Best Practice guide does make various overrides and customisations, and they may not fit for every customer - in fact, I plan to rename this guide into an 'Advanced Configuration' guide, since that is a more accurate portrayal of what it provides. The advice in the guide of how to create groups (e.g. for Datastores) is very useful, as many of our customers want to run different thresholds against different storage tiers.

Would be great to get your feedback on other aspects of the MP, and your experiences of deploying it. Please post more here, or feel free to email me direct - alec dot king at veeam dot com.

Thanks!
Alec