Getting Drive Specific Disk space information from hosts

[dar104]

I am using the universal forwarder on Windows Servers as I thought it would gather the needed information. However, it seems it only reports total disk space, _total, and not on the individual drives. Is there a way I can capture individual drives with perfmon or should I revert to WMI polling, which is a pain in our envrironment due to getting a service AD account?

If I have to switch to WMI polling is there any point in leaving the universal forwarder on the windows servers to collect information?

Any help would be appreciated.

[mark_chuman]

This worked for me!

index=perfstats sourcetype=PerfmonMk* host=servername C | timechart avg("%_Free_Space") by host

[feickertmd]

dar104,

I tried what you suggested, and I am not seeing results by drive letter. Can you contact me to discuss? I'd like to know better what to expect.

marc.feickert@optum.com

[dar104 · Accepted solution]

I found out you need to enable the counter in perfmon in the perfmon.conf file in etc/system/local on the host. I added the following and I was able to get perfmon to work.

[PERFMON:FreeDiskSpace]
counters = Free Megabytes;% Free Space
disabled = 0
instances = *
interval = 10
object = LogicalDisk

[Drainy]

Yes!
You can get the UF to do the polling for your, assuming it is running under an account with admin permissions. I used to use a VBS script to perform the WMI query locally and the results of the query would be forwarded onto the indexer, a nice simple way to achieve what you want.

[dar104]

All I was getting from the forwarder was total disk space % instead of individual drives. I think I figured out a solution. I am testing now. If it works I will put results here.

Thanks for the response.