banshee/linux-collection/linux/snmp/filesystems

Filesystems of a Linux host, by SNMP

Returns, for each mounted filesystem, its size, the space used and free, and the share used. Four watches are offered, each adjustable on the probe, among them the filesystem full within a week.

How it works

The collector reads hrStorageTable (HOST-RESOURCES-MIB) and keeps the rows of type hrStorageFixedDisk only: network mounts (hrStorageNetworkDisk) and the memory rows the agent also lists are left out. A filesystem is named by its mount point.

net-snmp does not tell the type of a filesystem: it files tmpfs and overlay with the disks, and itself hides devtmpfs, proc, sysfs and squashfs. In-memory and container mounts are therefore left out by their mount point, in the default selection: everything except /dev, /dev/*, /run, /run/*, /sys/*, /var/lib/docker/*, /var/lib/containers/* and /var/lib/kubelet/*. The selection can be changed on the probe; a tmpfs mounted elsewhere (/tmp) is watched like a disk.
A filesystem of size zero is not judged.
A host where no fixed disk is read stops the collector as misconfigured, saying how many rows and which types the agent served: it never shows green on nothing.
Full within a week projects the trend of the used share seven days ahead; the watch first learns the history of the filesystem.

Prerequisites

snmpd (net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.
The view granted to the poller includes hrStorage (.1.3.6.1.2.1.25.2).
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

# /etc/snmp/snmpd.conf
agentaddress udp:161
view   banshee included .1.3.6.1.2.1.25.2
rocommunity <community> 192.0.2.10 -V banshee
# or: rouser <user> priv -V banshee

Outputs

Name	Label	Unit	Per
`total`	Size	GiB	filesystem
`used`	Used space	GiB	filesystem
`free`	Free space	GiB	filesystem
`used-percent`	Used space	%	filesystem

Watches

Watch	Kind	Defaults	Checked
Used space	Above a threshold, on `used-percent`	warning 80 %, critical 90 %	yes
Full within a week	Above a threshold with a trend, on `used-percent`	warning 99 %, 7 days ahead	yes
Low free space	Below a threshold, on `free`	critical 5 GiB	no
Missing filesystem	Expected instances, on `used-percent`	no expected name	yes

Limits

Used and free space are what the agent counts in hrStorage; how it treats the blocks reserved for root depends on its version, so the share used may differ slightly from the one df shows.
Inodes are not served by this MIB: a filesystem full of small files is not seen. The linux/ssh/filesystems collector reads them.
hrStorageSize is 31 bits wide, in allocation units: a filesystem beyond 2³¹ units is miscounted by the agent itself.