2

I'm trying to set up alerts for low disk space conditions on a server (Windows Server 2008 R2 Enterprise, SP1). To do this I want to trigger an email via Task Scheduler whenever Event ID 2013 is logged in the System event log.

The problem is that Event ID 2013 doesn't seem to be occurring. The LowDiskSpaceMinimum and DiskSpaceThreshold registry keys are not present, which to my understanding should mean that Event 2013 occurs when the disk space of any partition drops below 10 percent.

I've tried to trigger this event on three servers now, on system drives (C:) or data drives (E:).

I have three theories:

  • The default threshold on 2008 R2 is much lower than 10% (but it must be VERY low given how full I'm making these drives in my tests)
  • The system only checks the disk space infrequently, and I'm just not waiting long enough
  • Something else is preventing this event from being logged that I haven't considered

If anybody can give me any suggestions I'd be grateful.

3 Answers 3

3

I eventually got this working. I had to specifically add the LowDiskSpaceMinimum and DiskSpaceThreshold registry keys and then it started to work.

I do agree that installing server monitoring software is probably a better way to go in a lot of cases, and if I was a sysadmin then I would do exactly that and centralise it to monitor all our servers. But my concern is only for one system so this approach works well enough for my needs (and means I don't need to wait for the sysadmins to actually do something!!)

If anybody else wants to set up something similar then here are the registry settings (DiskSpaceThreshold set to 10%):

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters]
"DiskSpaceThreshold"=dword:0000000a
"LowDiskSpaceMinimum"=dword:00000000

And here is the Task Scheduler job, which can be saved as an xml file and imported. Just change [ServerName], [YourDomain], [YourUserName] and the email addresses:

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2013-02-05T14:37:17.165247</Date>
    <Author>[YourDomain]\[YourUserName]</Author>
    <Description>Send an emailed warning when a low disk space event is recorded.</Description>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="System"&gt;&lt;Select Path="System"&gt;*[System[Provider[@Name='srv'] and EventID=2013]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-20</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>true</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
    <UseUnifiedSchedulingEngine>false</UseUnifiedSchedulingEngine>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <SendEmail>
      <Server>smtpServer.YourCompany.co.uk</Server>
      <Subject>Low disk space warning on server: [ServerName]</Subject>
      <To>[email protected]</To>
      <From>[email protected]</From>
      <Body>Disk space is running low on server: [ServerName] - please investigate.</Body>
      <HeaderFields />
      <Attachments />
    </SendEmail>
  </Actions>
</Task>
7
  • The Registry entries you provided there are not valid. a = 10 ?? Nov 28, 2013 at 16:55
  • That's how it appears when it's exported out of regedit. I've imported those settings onto several systems and received the alert emails that prove that it works. At a guess 0000000a is hex code for 10, but it really is a guess and I'm not inclined to try to decipher it as it's of no interest to me what encoding is used.
    – paulH
    Nov 28, 2013 at 17:06
  • My export: dword:00000030 and dword:00010240. I do not belive the data is exported as HEX. Nov 28, 2013 at 17:10
  • 1
    If it really won't work on your system (or you're too uncertain to try) then you could always add the registry settings manually (and then export them if you want to distribute it easily among several systems). I suppose it's always possible that regedit works differently on different versions of Windows. It is Microsoft after all!
    – paulH
    Nov 28, 2013 at 17:11
  • 1
    fwiw, 10 does equal a in hex. google.co.uk/#q=10+in+hex
    – paulH
    Nov 28, 2013 at 17:28
1

I have used paulH's approach in the past with success. However today I ran into a problem on a Windows 2016 Server: when saving the task I got an error stating that email is deprecated feature and Windows won't let you save the new task.

In order to make this work I found another approach on https://www.netwoven.com/2017/04/28/send-an-e-mail-windows-server-2012-task-scheduler-deprecated-feature-solved/ which uses Powershell as below:

Create a Powershell script as below and save it as smtpscript.ps1 to a known folder such as C:\Users\Public\Documents

$SmtpClient = new-object system.net.mail.smtpClient
$MailMessage = New-Object system.net.mail.mailmessage
$SmtpClient.Host = "mail.yourserver.com"
$SmtpClient.Port = 587
$SmtpClient.Credentials = New-Object System.Net.NetworkCredential( "[email protected]", "pw" );
$mailmessage.from = ("[email protected]")
$mailmessage.To.add("[email protected]")
$mailmessage.Subject = “An appropriate subject”
$mailmessage.Body = “An appropriate message body.”
$smtpclient.Send($mailmessage)

Save that script then create your task as above but under the Action tab use Start a program and enter these details:

Program/script: powershell.exe

Add Arguments (optional): C:\Users\Public\Documents\smtpscript.ps1

Save the task and you have an email alert.

0

If the registry value changes don't cause the Event ID 2013 record to be created, my experience has shown that one needs to restart the Server service a.k.a. LanmanServer service. That will cause the appropriate event record to be created. It appears that the service doesn’t monitor events generated when its registry keys are updated, so I needed to restart the service to get it to reread the updated key values.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .