Windows by Zabbix agent active template - Used Space returns Exabyte Value?

[Daniel4711]

Hello everyone,

of our 120 or so Windows servers, one has a problem with the vfs.fs.dependent.size item from the Windows by Zabbix agent active template.
We´re using the 7.0.0. Agent.

A Screenshot with the Total and the Used Value:



The trigger probably almost rolled over during the check.

Does anyone have any ideas?
I have already performed a restart (which really helps sometimes).
Reassigning the template (the old data was deleted) did not help either.
Partition D still has an extreme value.

[Markku]

I'm not a Windows filesystem expert, but does that D drive happen to contain some links or mounts or sparse files or something that could result in massive amounts of used data to be reported by the usual file usage APIs?

Maybe you can try other apps as well like TreeSize or whatever there are to calculate disk usage, to see if this is a common thing in all similar apps.

Also, if you can narrow down where that calculation goes wrong (= what causes it, how the Zabbix agent should behave differently), then you could open an issue in support.zabbix.com to get it fixed.

Markku

[markfree]

You see... the "Space: Used" and "Space: Used, in %" items receive data from "Get filesystems".
This master item uses the "vfs.fs.get" key, which retrieves raw information about the Windows file systems.

Actually, the "Get filesystems" item serves the "Get data" prototype item, and the "Space: Used" items filter that data with a JSONPath preprocessing step. There does not appear to be any data treatment.

Unless your host item has been tempered, the wrong value should be coming from your Windows server.

Are other file systems from the same host also displaying the wrong value?

[Daniel4711]

Hello everyone,

The server has 2 partitions and only one shows the problem.
Here is the JSON output from vfs.fs.get:

[
    {
        "fsname": "C:",
        "fstype": "NTFS",
        "fslabel": "",
        "fsdrivetype": "fixed",
        "bytes": {
            "total": 106438848512,
            "free": 80762896384,
            "used": 25675952128,
            "pfree": 75.8772736769082,
            "pused": 24.1227263230918
        },
        "options": null
    },
    {
        "fsname": "D:",
        "fstype": "NTFS",
        "fslabel": "WSUS-Data",
        "fsdrivetype": "fixed",
        "bytes": {
            "total": 1932735283200,
            "free": 2172493799424,
            "used": 1.8446743833951E+19,
            "pfree": 112.405139923096,
            "pused": 954437164.483749
        },
        "options": null
    }
]

As mentioned.. in Windows, everythings seems to be OK.


I'll continue my search.

[Markku]

I think vfs.fs.get uses GetDiskFreeSpaceEx call if I see this correctly: https://git.zabbix.com/projects/ZBX/...32/diskspace.c

If someone finds some limitations/special cases for compressed files etc when using that call.

Markku

[Daniel4711]

Ok.
Zabbix is not the Problem..


Very Strange..

[markosa]

What does Get-CimInstance win32_logicaldisk return? As Microsoft pages state "Starting in PowerShell 3.0, this cmdlet has been superseded by Get-CimInstance." Get-WmiObject (Microsoft.PowerShell.Management) - PowerShell | Microsoft Learn

[Daniel4711]

Thanks for the tip.
Somehow get-wmiobject is stored in my brain.


get-cmiinstance also returns the wrong value.
A get-psdrive also returns the wrong value.
A get-volume returns the correct value.

I am surprised that drive C: is not affected.

If I cannot correct the error, I will recreate the drive.