How to Log Low Disk Space Events in Windows 10 and 11 Using Performance Monitor

Prepare the drive and alert threshold​

Have the following ready:

• Administrative access to the PC.
• The drive letter to monitor, such as C: or D:.
• A free-space threshold, such as 15%.
• A descriptive collector-set name, such as Low Disk Space C.

This guide monitors a specific local drive. Select the individual drive instance rather than _Total so that the alert corresponds to the volume you actually want to protect. Microsoft’s disk-monitoring documentation identifies LogicalDisk → % Free Space as the counter for the percentage of free space on a selected logical drive.

Enter 15, not 0.15, for a 15% threshold. The condition concerns remaining free space, not used space: choose Below, not Above. Microsoft’s documented disk-alert exercise uses this same counter and comparison, with a numeric percentage as the limit.

The alert action in this guide records an event; it does not configure an email, desktop notification, cleanup operation, or script. Those require separate actions. Leave the task and additional collector-trigger options unconfigured for this setup.

Windows 10 compatibility should not be confused with its support lifecycle. Microsoft ended standard Windows 10 support on October 14, 2025; organizations retaining Windows 10 should check the servicing arrangements applicable to their edition.

Create the low-disk-space alert in Performance Monitor​

Open Performance Monitor and create an alert set​

• Open Start, search for Performance Monitor, right-click the result, and select Run as administrator. Approve the User Account Control prompt.
• In the left pane, expand Data Collector Sets.
• Right-click User Defined, then select New → Data Collector Set.
• Enter Low Disk Space C as the name, or use another name that identifies the drive.
• Select Create manually (Advanced), then select Next.
• Select Performance Counter Alert, then select Next.

Be sure to choose the alert option, not the Performance counter option beneath Create data logs. Microsoft documents these as separate collector types: the alert evaluates thresholds, while a performance-counter log records sampled counter data.

Choose the drive and percentage​

• On the page asking which performance counters to monitor, select Add.
• Keep the counter source set to the local computer.
• Expand LogicalDisk in the available counters.
• Select % Free Space.
• Under Instances of selected object, select C:. Substitute the appropriate drive letter if you are monitoring another volume.
• Select Add, then OK.
• Select the newly added counter in the wizard.
• Set Alert when to Below.
• Enter your percentage in Limit. For this example, enter 15.
• Select Next, then Finish to create the set.

The selected counter should identify the intended drive, equivalent to:

\LogicalDisk(C:)\% Free Space

A computer-name prefix may also appear. Before continuing, check the drive letter, counter name, comparison, and limit together. The intended rule is “C: has less than 15% free,” not “disk activity exceeds 15%.”

Enable event logging and start monitoring​

Creating the set is only part of the configuration. Open the alert collector inside the set to configure its action.

• Under Data Collector Sets → User Defined, select Low Disk Space C.
• In the main pane, right-click the collector whose type is Alert, then select Properties. Its automatically generated name may differ from the name you gave the set.
• Open the Alerts tab and check the counter and threshold.
• Open Alert Action.
• Select Log an entry in the application event log.
• Leave any option to start another data collector set unconfigured.
• Leave Alert Task unconfigured.
• Select OK to save the collector’s properties.

Despite the checkbox wording, the destination for this Performance Logs and Alerts event is the Diagnosis-PLA/Operational channel, not the ordinary Windows Logs → Application log. Microsoft’s alert-action documentation explicitly identifies that destination.

Now right-click Low Disk Space C in the left pane and select Start. The set must be running to monitor the counter. You can also start it from an elevated Command Prompt with:

logman start "Low Disk Space C"

No Windows restart is required to start collection. The command starts the named data collector set; it does not create one if the name is wrong.

Alert collectors sample periodically rather than continuously. Microsoft documents a default alert sampling interval of 15 seconds. Allow more than one sampling interval when testing rather than expecting an immediate event the moment you select Start.

Test the alert without filling the drive​

Do not deliberately fill the Windows drive to test this alert. Instead, temporarily raise the threshold above the drive’s current free-space percentage, then restore the intended limit. This tests the comparison and event action without consuming storage.

• In Performance Monitor, select Monitoring Tools → Performance Monitor.
• Select the green + button and add the same LogicalDisk → % Free Space → C: counter.
• Observe its current value. For example, suppose it is approximately 46% free. Microsoft documents adding this counter to the live monitor for checking the selected drive’s free-space percentage.
• Return to Data Collector Sets → User Defined.
• Right-click Low Disk Space C and select Stop.
• Open the alert collector’s Properties → Alerts.
• Temporarily change Limit to a value above the observed reading—for example, 60 when the drive is about 46% free. Keep Alert when set to Below.
• Save the change and start the set again.
• Wait through several sampling intervals, then check Event Viewer using the next procedure.

This temporary rule deliberately makes the current reading meet the alert condition. Microsoft defines alert thresholds using greater-than or less-than comparisons and provides event logging as an action when the threshold is met. The test does not require changing any files on the monitored drive.

Restore the real threshold immediately after testing. Stop the set, change the limit back to 15 or your chosen percentage, save it, and start it again. Do not leave the deliberately high test threshold active.

Find and verify Event ID 2031​

• Press Windows+R, enter eventvwr.msc, and press Enter.
• Expand Applications and Services Logs → Microsoft → Windows → Diagnosis-PLA.
• Select Operational.
• Select Refresh after allowing time for the alert to run.
• Look for Event ID 2031 at the time of your test.

Microsoft documents event 2031 in the Microsoft-Windows-Diagnosis-PLA/Operational log as the event written when an alert threshold triggers and event logging is enabled.

For a busy log, select Filter Current Log, enter 2031 in the event-ID field, and select OK. Open a matching event and examine its General message. Match the counter path, measured value, threshold, and timestamp to your test; an older event or an alert for another drive does not verify this configuration. Event Viewer’s filtering and event-details controls let you narrow the records without deleting them.

Verification is complete when you have both:

• A matching threshold event from the controlled test.
• The collector running again with the intended production percentage restored.

Alternative: create the same alert with an explicit sampling interval​

The command-line method is useful if you want a reproducible configuration with a clearly specified interval. Use it instead of creating the same named set through the wizard.

Open Command Prompt as administrator, then run:

logman create alert "Low Disk Space C" -th "\LogicalDisk(C:)\% Free Space<15" -si 00:01:00 -el
logman start "Low Disk Space C"

Here:

• -th supplies the counter and less-than threshold.
• -si 00:01:00 sets a one-minute sampling interval.
• -el enables event logging.

The quotes keep the counter path, spaces, and < comparison together as one argument. These are Command Prompt commands; the counter names shown are for an English-language Windows installation. Microsoft documents both the threshold syntax and localized display names for alert counters.

Return to Performance Monitor → Data Collector Sets → User Defined to inspect the resulting set. Use the same controlled test and Event Viewer verification described above. Microsoft’s Windows support documentation also demonstrates creating an alert with logman, inspecting it in Performance Monitor, and starting it separately.

Troubleshoot a missing alert​

The collector exists, but no event appears​

Check these in order:

• Confirm the set is running. Creating or saving a set is not the same as starting it.
• Confirm the comparison. For low free space, use Below.
• Confirm the counter. It must be % Free Space, not Free Megabytes or an activity counter.
• Confirm the individual drive instance.
• Confirm the event action is enabled on the alert collector, not merely that the set exists.
• Allow several sampling intervals after starting the test.

These checks correspond to the documented alert components: a selected counter, a threshold comparison, a sampling interval, an enabled event action, and a running collector set.

You are checking the Application log​

Navigate to Applications and Services Logs → Microsoft → Windows → Diagnosis-PLA → Operational instead. If its context menu offers Enable Log, enable it before repeating the controlled test. Enabling a log does not recreate records that were never captured. Do not clear existing events as a troubleshooting step; use a timestamp or filter to isolate the new test.

The set fails to start or access is denied​

Reopen Performance Monitor with Run as administrator and retry. Record the exact error if it still fails. Microsoft’s performance troubleshooting procedures use an elevated command prompt for creating and starting data collector sets. Avoid changing service-account credentials or security permissions simply to get past an unexplained error.

Monitoring stopped after a restart​

Do not assume a manually started set automatically resumes after Windows restarts. Microsoft notes that manually started performance collection needs to be started again after a restart. Check the set after reboot and start it again as necessary. For unattended monitoring, make startup and post-reboot verification part of the administrative deployment rather than treating one successful manual test as permanent coverage.

Stop or remove the alert safely​

To suspend monitoring, right-click the set and select Stop, or run:

logman stop "Low Disk Space C"

Stopping preserves the configuration so you can start it again later. To remove the configuration entirely, stop it first, then run:

logman delete "Low Disk Space C"

Check the name carefully before deletion, especially if other administrators have created collector sets. Microsoft documents stop as stopping collection and delete as deleting the existing collector.

If the controlled test still produces no matching event, escalate with the Windows version, collector name, exact counter path, threshold, sampling interval, start error if any, and the test timestamp. Include relevant Diagnosis-PLA/Operational records rather than changing registry settings or rebuilding performance counters without a diagnosed counter problem.