fleet/it-and-security/lib/linux/policies/disk-space-check.yml
kilo-code-bot[bot] 59e17040f2
Add disk space check policies for workstations (#41212)
## Summary

- Adds cross-platform disk space check policies (macOS, Windows, Linux)
scoped to the workstations team
- Each policy calculates the percentage of available disk space relative
to total disk space and **fails when available disk space is 10% or
less**
- macOS/Linux policies query the `mounts` table for the root partition
(`/`); Windows policy queries the `logical_drives` table for NTFS drives
- Resolution contact channel is `#help-it`

### New files
- `it-and-security/lib/macos/policies/disk-space-check.yml`
- `it-and-security/lib/windows/policies/disk-space-check.yml`
- `it-and-security/lib/linux/policies/disk-space-check.yml`

### Modified files
- `it-and-security/teams/workstations.yml` — registers the three new
policies

### How it works

| Platform | Query logic |
|---|---|
| macOS | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Linux | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Windows | `SELECT 1 WHERE (SELECT CAST(SUM(free_space) AS REAL) /
SUM(size) FROM logical_drives WHERE file_system = 'NTFS') > 0.10` |

- **Pass (returns rows):** available disk space is more than 10%
- **Fail (returns no rows):** available disk space is 10% or less

### Why >10% free disk space matters

Each policy description now includes context on why maintaining
sufficient free disk space is important:
- **System stability:** Low disk space can cause system instability,
slowdowns, and crashes
- **OS requirements:** Operating systems need free space for virtual
memory/swap, temporary files, and system updates
- **Application reliability:** Applications may fail to save data or
function properly when disk space is critically low
- **Data protection:** Keeping sufficient free space ensures reliable
performance and prevents data loss

Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772934328893319?thread_ts=1772933835.386689&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)

---------

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
2026-03-07 19:52:02 -06:00

14 lines
972 B
YAML

- name: Linux - Sufficient disk space available
query: SELECT 1 FROM mounts WHERE path = '/' AND CAST(blocks_available AS REAL) / blocks > 0.10;
critical: false
description: >-
This policy checks if more than 10% of disk space is available on the root partition. Devices with 10% or less available disk space will fail this policy.
Having more than 10% of disk space available is important because low disk space can cause system instability, slowdowns, and crashes.
Operating systems need free space for virtual memory/swap, temporary files, and system updates.
Applications may fail to save data or function properly when disk space is critically low.
Keeping sufficient free space ensures reliable performance and prevents data loss.
resolution: |-
Free up disk space by removing unnecessary files, clearing package caches, or uninstalling unused applications.
If the issue persists, please reach out in #help-it.
platform: linux