Monitoring with PowerShell: Predict when disk is full

I’ve always liked predictive monitoring as it allows you to be as proactive as you can be – making small analysis on stuff like disk space can make a huge difference in how you respond to incidents but I rarely see this integrated into RMM systems – Often there are some reports on which you could extrapolate this data manually but that means you’ll only do it on demand and it will require your time.

This monitoring script creates a datapoint in a file each 30 minutes and when more than 15 data points have been collected it’ll start using the collected information to predict when the disk might be running out of space. Of course this works better over time when there are a lot of data points available. All the file really contains is a representation of how much disk space is available and compares that to the previous results.

You can use this script to help your clients replace or expand disks when required, or upgrade to different infrastructure if you need that. It only does this for drives that have a volume letter.

For the logic of it all I’ve borrowed some of the data from this blog, as my math skills are not as good as his. 😉

The Script

$Volumes = Get-Volume | Where-Object { $_.DriveLetter -ne $null -and $_.DriveType -eq "fixed" }
$SpaceMonitorPath = "C:\programdata\SpaceMonitor"
$null = new-item $SpaceMonitorPath -ItemType Directory -Force
foreach ($Volume in $Volumes) {
    if ($Volume.DriveLetter -eq 0) { continue } #fix for server 2012 recovery volume

    $Date = (get-date).ToShortDateString()
    $time = (get-date).ToShortTimeString()
    $LastWriteTime = (get-item "C:\programdata\SpaceMonitor\$($volume.DriveLetter).txt" -ErrorAction SilentlyContinue).LastWriteTime
    $Datapoints = get-content "$SpaceMonitorPath\$($volume.driveletter).txt" | convertfrom-csv -Delimiter ',' -Header "DriveLetter", "SizeUsed", "Date", "Time"
    if ($LastWriteTime -lt (get-date).AddMinutes(-30)) {
        write-host "writing datapoint"
        $SizeUsed = $Volume.Size - $volume.SizeRemaining
        Add-Content "$SpaceMonitorPath\$($volume.driveletter).txt" -value "$($volume.DriveLetter),$([math]::round($sizeused /1gb,2)),$Date,$Time" -Force
    }
    if ($datapoints.count -gt 15) {
        $DaysInDP = ($datapoints.Date | Select-Object -Unique).count

        $tempnsumxy = 0;
        $sample = 0;
        $sumx = 0;
        $sumy = 0;
        $xsquaredsum = 0;
        foreach ($datapoint in $datapoints) {
            $sumx = $sumx + $sample;
            $sumy = $sumy + $datapoint.SizeUsed;
            $tempnsumxy = $tempnsumxy + ($sample * $datapoint.SizeUsed);

            $xsquared = $sample * $sample;
            $xsquaredsum = $xsquaredsum + $xsquared

            $sample ++
        }
        $nsumxy = $Datapoints.count * $tempnsumxy;
        $sumxy = $sumx * $sumy;
        $nsumsquaredx = $Datapoints.count * $xsquaredsum;
        $sumxsquared = $sumx * $sumx;
        $slope = ($nsumxy - $sumxy) / ($nsumsquaredx - $sumxsquared);

$slopesumx = $slope * $sumx;
        $trend = ($sumy - $slopesumx) / $Datapoints.count;
        $daysleft = [int]((($volume.Size / 1gb - $trend) / $slope) - $DaysInDP);
        $estimatedFullDate = If ($daysleft -like "-\*") { "Disk is gaining space. Cannot calculate date" } else { (get-date).AddDays($daysleft) }
[PSCustomObject]@{
Driveletter = $volume.DriveLetter
EstimatedFullInDays = $daysleft
EstimatedFullDate = $estimatedFullDate
}
}
}

And that’s it! as always, Happy PowerShelling 🙂

Monitoring with PowerShell: Predict when disk is full

The Script

Recent Articles

CyberDrain CTF returns! (and so do I!)

Intro

Intro