Additional alerts for Oracle for file system Approching Maximum Capacity?

[majilan1]

Hi Everyone,

I run into an issue today in SIT where TIV0 was inaccessible because a similar directory was full.

I'm trying to set one alert for DEV and one for SIT and the folder path for each environment is :

DEV:/mms/ora1200/u00/oracle.

SIT:/mms/ora1201/u00/oracle.

this is what i have so far :

index=A   "/mms/ora1200/u00/oracle"  source= B

| stats latest(storage_used*) as storage_used*  latest(storage_free*) as storage_free* by host mount

| where storage_used_percent>90

| eval storage_used=if(storage_used>1000,(storage_used/1000). " GB" ,storage_used+"  MB"),  storage_free=if(storage_free>1000, (storage_free/1000, (storage_free/1000).  " GB", storage_free+" MB")

Any feedback will be appreciated.

[gcusello]

Hi @majilan1,

what is the result of your search?

does it run or not?

if not, what's the output?

Anyway I see thet you used a field "storage_used_percent" in the where command that isn't present in the stats command: after a stats command you have only the fields present in the command itself, in other words you don't have the field "storage_used_percent".

you have to calculate it from the fields you have using eval or, if present, to add it to the stats command.

index=A   "/mms/ora1200/u00/oracle"  source= B
| stats 
   latest(storage_used*) as storage_used*
   latest(storage_free*) as storage_free*
   latest(storage_used_percent) AS storage_used_percent
   BY host mount
| where storage_used_percent>90
| eval 
   storage_used=if(storage_used>1000,(storage_used/1000)." GB",storage_used+"  MB"),
   storage_free=if(storage_free>1000,(storage_free/1000,(storage_free/1000).  " GB", storage_free+" MB")

Ciao.

Giuseppe

[majilan1]

My query does run, but it generates 0 events, I tried yours and is the samething.