Best Practices for Low Disk Space Alerting Using ControlUp Advanced Triggers

A common challenge in managing disk space alerts in ControlUp arises when disk space percentages hover near a critical threshold, causing redundant or false-positive alerts. One user described a scenario where they used two separate triggers: one to alert when disk space dropped below or equal to 10% for 30 minutes, and a second trigger to fire an “all clear” alert when disk space rose above 10% for 30 minutes. This setup, however, resulted in frequent false positives, especially with the “all clear” alert, due to disk space fluctuating near the 10% boundary.

The root of the problem lies in the independent nature of these two triggers and their durations. For example, if disk space dips below 10% briefly and then recovers, the separate all-clear trigger fires independently, which is often unnecessary or too noisy. The discussion clarified that ControlUp triggers do not chain, meaning one trigger cannot wait for another to fire before acting. Because of this limitation, managing disk space alerts effectively requires a different approach.

The recommended solution is to use a single Advanced Trigger that monitors logical disks rather than entire computers, applying a filter such as free space less than 10%, capacity above 10 GB (to exclude system or recovery partitions), and optionally focusing on specific volumes like the C: drive for operating system disks. This Advanced Trigger should be set with a duration of around 30 minutes, where the incident opens only after disk space has been below 10% continuously for that period. Importantly, the incident only closes automatically when disk space has been above 10% continuously for 30 minutes. This approach eliminates false positives caused by short dips or recoveries because no alert is generated unless the threshold is crossed for the full time duration, and the all-clear condition is represented by the incident resolution—no separate “all clear” trigger is necessary.

Additionally, setting a minimum time between incidents (such as 1 to 4 hours) can help prevent repetitive alerts for the same disk volume oscillating near the threshold. This strategy ensures alerts are meaningful and actionable, reducing alert noise in environments where disk space fluctuates near critical levels.

For more details on configuring Advanced Triggers and alert management in ControlUp, users can refer to the official ControlUp documentation and the ControlUp Academy: https://docs.controlup.com and https://cuacademy.controlup.com.

Read the entire ‘Best Practices for Low Disk Space Alerting Using ControlUp Advanced Triggers’ thread below:

Curious on how others are alerting on low disk space. We have a trigger for when disk space is < or = 10% for 30 min to fire an alert and that seems to work.
We have a second trigger that when disk space is >10% for 30 min, fire an all clear alert. We are finding that when disk space hovers around 10% we get false positives on both but mostly the >10% all clear alert.

How have others build low disk space alerting and how does it work for you?

You can use Advanced Trigger for Use Logical Disks, not Computers, so you alert per volume:
1. Filter:
◦ Free Space (%)is less than 10
◦ Capacityis greater than 10 GB(drops recovery/system partitions)
◦ Optional: Drive Letter is `C:` for OS disks, or a separate trigger for data volumes
2. Duration:15–30 minutes (your 30 min is fine)
3. Min time between incidents:1–4 hours so a volume that just cleared cannot immediately re-alert

Thank. I believe that’s what we have. The issue is the duration. If a disk drops below the % for 10 min and then above for 30 in the second alert fires and we don’t really care at that point.

Was hoping to find a way to get the >10% to fire only after the <10% trigger fires

ControlUp triggers don’t chain. The >10% trigger cannot wait for the <10% trigger to have fired.
Use one Advanced Trigger (<10% for 30 min). The incident only opens after that, and only closes after it has been back above 10% for 30 min. A 10-minute dip never opens, so there is nothing to clear.
Drop the second trigger. All-clear = that incident closing, not a separate >10% rule.

Continue reading and comment on the thread ‘Best Practices for Low Disk Space Alerting Using ControlUp Advanced Triggers’.  Not a member? Join Here!