SCOM 2012: Learn How to Override Free Space Monitoring for Page File Drive

I operate an extensive VM infrastructure. One of the first things I had to do when implementing SCOM was disable the alert for logical disk free space on the drive that I move the page file too. On our VM’s, we move the page file to another drive on a separate data store to improve the performance of our VM’s. The page file is the only thing stored on this drive, so we make the drive as small as possible (i.e. a 3.9GB page file will be placed on a 4GB drive). This creates problems in SCOM, because the amount of free space is so low.

This article will detail a method to override the monitor for these drives, thus removing the alerts from the console. This process will only override the page file drive, and will only apply to devices with this drive. This article assumes that all of your VM’s place the page file on the same drive letter, and that this drive letter will never be used for something else.

SCOM Group

So the first thing we must do is create a group for our VM’s. To do this, go to the “Authoring” node of your SCOM console. Right-click on “Groups” and select “Create a new Group…”. Give your group a name (something like “VM Servers”) and a description. For the management pack option, I recommend creating a new one named “VM-Servers”. This will allow you store all of your VM-related items in one management pack. Next, press “Next” until you are under the “Dynamic Members” node.

Click the “Create/Edit rules…” button. Select “Windows Computer” from the drop-down and click “Add”. In the “Property” box, select “Device Name”. In the “Operator” box, select “Equals”, and finally in the “Value” box put the drive letter of your page file drive followed by a colon (:).


Press OK and finish the create group wizard. Please note that we created a dynamic group, so any drive S will be excluded, whether it is a VM or not. That is why it is important that the drive you pick is not in use as a logical disk anywhere else. Now you make be wondering why we cannot queue on something a little more specific to ensure that we are only targeting VM’s and not a physical server. While it is certainly possible to do that, the output of the query (notice that screen says “Query Builder”) must equal S: for it to match the alert that we will override. The only way to make it output S: is to queue off that value. If this a problem in your environment, I would recommend doing an “Explicit Members” group and simply add all of your VM’s to this group manually.

Override the Monitor

Next, we need to override the free space monitor for our VM group. To do this, expand the “Management Pack Objects” tab under the “Authoring” node. Select the “Monitors” item. In the “Look for:” box, type in “Logical Disk Free Space”. You will likely see a different number of management packs than me depending on which server OS management packs you have installed. I have MP’s for Server 2003, 2008, and 2012 installed. No matter which management packs you have, you are looking for the “Logical Disk Free Space (%) Low” monitor.


You will have to do this next process for each monitor. You can see out to the right where the monitor indicates that it is “Not inherited”. If this monitor were inherited from another monitor, you could do the override on the parent and it would apply to all of the child monitors.

To insert the override, right-click on the monitor, go to “Overrides” then “Override the Monitor” and then “For all objects of another class”.


You will want to click the “View all targets” radio button, and then enter the first letters or word of the group we created earlier. Select that group and click “OK”. Now, check the box for “Enabled” and change the “Override Value” to “False” in the “Overrides Properties” window. Next, select the management pack where you want the override saved (I recommend the VM MP we created earlier) and click on OK.


Remember to do this process on all Logical Disk Free Space monitors. Now you can go back to the alerts page and see all of the alerts disappear for your page file drive.


As I said in the opening, this is one of the first things I had to do after installing SCOM and adding some agents. I hope this helps in your environment. Come back in the next few weeks for more helpful tips and tricks in Operations Manager.



Contact Us

On Key

More Posts

WME Cybersecurity Briefings No. 004
Cyber Security

WME Security Briefing 11 April 2024

Mispadu Trojan Exploits Windows Vulnerability to Target Financial Data Overview The Mispadu banking trojan has intensified its operations as it’s exploiting an already patched Windows SmartScreen flaw. Since its initial identification in 2019, Mispadu has primarily preyed on

Read More »
WME Cybersecurity Briefings No. 003
Cyber Security

WME Security Briefing 29 March 2024

Russian hackers escalating their cyber warfare, deploying TinyTurla-NG to breach European NGOs. Cisco Talos reveals a targeted attack against organizations advocating democracy and supporting Ukraine. With their sophisticated methods, these cyber attackers are bypassing antivirus defenses

Read More »
Be assured of everything

Get WME Services

Stay ahead of the competition with our Professional IT offerings.