Disk Space Alert
Standard Windows Monitoring Threshold Parameters | Lazy Admin Blog
Monitoring thresholds are often dictated by the Service Level Agreement (SLA) or Statement of Work (SoW) signed with your client. However, if you are setting up a new environment or looking for baseline recommendations, these industry standards are a great place to start.
The Performance Monitoring Matrix
Below are the typical thresholds used for enterprise Windows environments. These are designed to minimize “alert fatigue” while ensuring you have enough time to react before a service failure occurs.
| Metric | Polling Interval | Warning (Yellow) | High/Critical (Orange) | Alert/Emergency (Red) |
| CPU Utilization | 5 Minutes | > 80% for 3 polls | > 90% for 2 polls | > 95% for 2 polls |
| Memory (Available MBytes) | 5 Minutes | < 100 MB | < 50 MB | < 20 MB |
| Memory (Pages/sec) | 5 Minutes | > 500 | > 1000 | > 5000 |
| Disk Free Space (%) | 15 Minutes | < 15% | < 10% | < 5% |
| Disk Queue Length | 5 Minutes | > 2 per spindle | > 5 per spindle | > 10 per spindle |
| Network Utilization | 5 Minutes | > 60% | > 80% | > 90% |
| Service Status | 1 Minute | N/A | Stopped (Manual) | Stopped (Automatic) |
Understanding “Remedy on Demand” (RoD) Integration
In many enterprise environments, these thresholds are tied directly to an ITSM tool like Remedy on Demand (RoD).
- Warning levels usually trigger an email notification or a low-priority ticket.
- Alert levels generate a high-priority incident in RoD, often triggering an automated page to the on-call engineer.
Key Considerations for Polling Intervals
- Short Intervals (1-2 mins): Great for critical services, but increases the load on the monitoring server and the target agent.
- Long Intervals (15-30 mins): Ideal for Disk Space or non-critical capacity trends.
- The “3-Poll Rule”: To avoid alerts caused by temporary spikes (bursty CPU usage), set your monitoring tool to only trigger a ticket if the threshold is exceeded for 3 consecutive polling intervals.
A Sample Template:
