Resolving WinCC PERFMON Low Free Megabytes Alarm on Small

Problem Overview

WinCC Runtime, from Version 6 onward, includes a built-in System Monitoring subsystem that periodically samples Windows Performance Monitor (PerfMon) counters and raises internal alarms when critical resources fall outside their healthy range. One of the most frequently reported false-positive events on WinCC Runtime stations is the PERFMON: Free Megabytes on X: alarm, which fires when the free space on a designated drive drops below an internal threshold.

On installations where drive X: is reserved for Siemens license files, redundancy archives, audit trails, or any other low-volume data set, the alarm is operationally meaningless. A 2 GB license partition that is 90% full is normal steady-state — yet the internal threshold logic raises a red alarm in the WinCC Alarm Logging view, generating nuisance operator pages and obscuring the genuine system faults the alarm class was designed to surface.

WinCC System Monitoring Architecture

The System Monitoring feature was introduced with WinCC V6.0 as a runtime self-diagnostic layer. It is implemented as a WinCC-internal service that:

1. Polls a fixed set of Windows PerfMon performance counters at a configurable sample interval (default 5 s).
2. Compares each sample against a configured or hardcoded threshold.
3. Generates a WinCC alarm via the internal message class SYS_MON when the threshold is violated for N consecutive samples.
4. Clears the alarm automatically when the counter returns to a healthy range.
5. Forwards both raise and clear events to the WinCC Alarm Logging database and to subscribed AlarmControl views on operator screens.

The default counter set monitored out-of-the-box is summarised below.

The free-disk counter is the only one in the default set that derives its effective threshold from the total capacity of the drive rather than from a user-editable absolute value. As confirmed in field experience, the alarm is raised when free disk space falls below approximately 80% of the drive's total capacity — appropriate for a 500 GB data drive, but nonsensical for a 2 GB license partition that is designed to be near-full by design.

The counter itself is exposed by the Windows kernel through the standard LogicalDisk performance object. Microsoft documents the data collector set workflow and the perfmon command-line interface in the Microsoft Learn Performance Monitor guide. The WinCC layer adds alarm-signaling on top of the raw counter; the counter is not modified.

Root Cause Analysis

The defect is a combination of three engineering choices, each defensible in isolation but compounding into the field-reported false positive:

1. Absolute MB is a poor metric for variable-size volumes. The PerfMon counter LogicalDisk\Free Megabytes is an unsigned 64-bit integer that reports raw free bytes divided by 1,048,576. It carries no concept of drive size, percent utilization, or workload class. A 500 GB volume and a 2 GB volume report the same counter type but require completely different thresholds.
2. WinCC's hardcoded scaling maps to capacity, not to a configurable absolute. Siemens' internal logic scales the absolute threshold to a percentage of the drive's total size, but the mapping is not exposed in the configuration UI and cannot be edited by the integrator. There is no field in the System Monitor editor that accepts a percent-free value.
3. No exclusion mechanism exists for system or license drives. There is no flag in the WinCC System Monitor configuration to suppress monitoring of a particular drive letter. The integrator cannot tell WinCC to ignore X: when the design intent is to leave the license partition near-full permanently.

The net result is a vendor-acknowledged gap: the WinCC documentation is silent on the percentage-based alternative, and no graphical editor knob exists to change the underlying behavior. Customer Support consistently recommends filing a problem report rather than providing a hotfix, because the change is an architectural enhancement rather than a defect repair.

Affected Versions and Environments

The behavior is consistent across Windows Server 2008 R2, 2012 R2, 2016, 2019, and 2022 — every Windows version on which WinCC V6/V7 Runtime is supported. The 32-bit versus 64-bit Runtime does not change the counter interpretation.

Diagnostic Procedure

Before applying any workaround, confirm that the alarm source is the built-in System Monitor and document the current counter state.

1. Open WinCC Alarm Logging (Runtime). Locate the PERFMON: Free Megabytes on X: message. Note the message class (SYS_MON), the message number, the affected drive letter, and the timestamps of the most recent three occurrences.
2. Open WinCC Explorer → Tools → System Monitor. Confirm that the alarm is generated by the System Monitor subsystem and not by a custom user script or a third-party add-in.
3. Verify the counter in Windows PerfMon.
   1. Press Win + R, type perfmon, and press Enter. Right-click the tool and select Run as administrator if User Account Control prompts.
   2. In the Performance Monitor tree, navigate to Monitoring Tools → Performance Monitor.
   3. Click the green + (Add Counter) button in the toolbar.
   4. In the Add Counters dialog, select the LogicalDisk performance object and the Free Megabytes counter.
   5. In the Instances of selected object list, pick X:. If the drive is not listed, verify the drive is mounted and formatted as NTFS or ReFS.
   6. Click Add, then OK.
4. Record the raw counter value and the total size of drive X: (right-click the drive in Windows Explorer → Properties → General tab).
5. Calculate the actual percentage free with the formula:

   PercentFree = (FreeMegabytes × 1,048,576) / TotalBytes × 100

6. Cross-check with PowerShell for an authoritative read:

   Get-Counter '\LogicalDisk(X:)\Free Megabytes' | Select-Object -ExpandProperty CounterSamples | Select-Object InstanceName, CookedValue
   Get-Volume -DriveLetter X | Select-Object Size, SizeRemaining

If the calculated percentage is greater than 20% (i.e. the drive is less than 80% full) and the WinCC alarm is still active, the alarm is a confirmed false positive driven by the hardcoded MB logic. Proceed to the workaround section.

Configuration — Editing the System Monitor in WinCC Explorer

The System Monitor editor in WinCC Explorer exposes thresholds for CPU and memory but does not expose the free-disk threshold. The change is therefore not directly possible through the standard configuration UI. The remaining options are the workarounds in the following sections.

What is Editable in the System Monitor Editor

• Sample interval (default 5 s, range 1–60 s)
• CPU % Idle Time threshold (default 20%)
• Memory Available MBytes threshold (default 50 MB on 32-bit / 200 MB on 64-bit)
• Alarm class for each threshold event

What is NOT Editable in the System Monitor Editor

• Free Megabytes threshold — no field exists in the editor
• Per-drive suppression — no field exists
• Threshold unit (MB vs. %) — no field exists
• Counter path override — no field exists

This gap is the reason a workaround rather than a configuration change is required.

Workaround 1 — Percentage-Based Monitoring via Custom VBScript

The cleanest engineering solution is to replace the built-in disk monitoring with a custom VBScript action that calculates a percentage and raises a WinCC alarm only when a user-defined percentage threshold is crossed. This sidesteps the hardcoded MB logic entirely while preserving the System Monitor for CPU and memory events.

Create a new scheduled task under Global VBScript in the WinCC Explorer project tree, schedule it to run every 60 seconds, and attach the following action.

' File: DiskMonitor_Percentage.vbs
' WinCC Scheduled Task: Global VBScript, 60 s cycle
' Purpose: Raise a WinCC alarm when free disk percentage on drive X
'          falls below a configurable threshold.
' Tag prerequisites (create in WinCC Tag Management):
'   DiskPctFree_X    (analog, %)
'   DiskMBFree_X     (analog, MB)
'   DiskAlarmWarn_X  (binary, bit 0)
'   DiskAlarmCrit_X  (binary, bit 1)
'   DiskMonitorSts_X (binary, status word)

Option Explicit

' ---------------- Configuration ----------------
Const DRIVE_LETTER     = "X:"
Const WARN_PCT         = 10    ' Warning threshold  (% free)
Const ALARM_PCT        = 5     ' Critical threshold (% free)
Const HYSTERESIS_PCT   = 2     ' Recovery margin     (% free above threshold)
Const SAMPLE_INTERVAL  = 60    ' Schedule cycle in seconds
Const ENABLE_TRACING   = True  ' Emit trace lines for diagnostics
' ------------------------------------------------

Dim fso, drive, totalBytes, freeBytes, pctFree

On Error Resume Next

Set fso = CreateObject("Scripting.FileSystemObject")
Set drive = fso.GetDrive(DRIVE_LETTER)

If Err.Number <> 0 Then
    If ENABLE_TRACING Then
        HMIRuntime.Trace "DiskMonitor: GetDrive error " & Err.Number & _
                         " on drive " & DRIVE_LETTER & " - " & Err.Description
    End If
    Err.Clear
    Exit Sub
End If

If drive.IsReady Then
    totalBytes = drive.TotalSize
    freeBytes  = drive.FreeSpace

    If totalBytes > 0 Then
        pctFree = (freeBytes / totalBytes) * 100
    Else
        pctFree = 0
    End If

    ' --- Write trend tags ---
    HMIRuntime.Tags("DiskPctFree_X").Write pctFree
    HMIRuntime.Tags("DiskMBFree_X").Write freeBytes / 1048576

    ' --- Evaluate thresholds with hysteresis ---
    If pctFree < ALARM_PCT Then
        If HMIRuntime.Tags("DiskAlarmCrit_X").Read = 0 Then
            If ENABLE_TRACING Then
                HMIRuntime.Trace "DiskMonitor: CRITICAL free space on " & _
                                 DRIVE_LETTER & " (" & _
                                 FormatNumber(pctFree, 2) & "% free, " & _
                                 FormatNumber(freeBytes/1048576, 1) & " MB)"
            End If
        End If
        HMIRuntime.Tags("DiskAlarmCrit_X").Write 1
        HMIRuntime.Tags("DiskAlarmWarn_X").Write 1
        HMIRuntime.Tags("DiskMonitorSts_X").Write 2   ' 2 = critical

    ElseIf pctFree < WARN_PCT Then
        If HMIRuntime.Tags("DiskAlarmWarn_X").Read = 0 Then
            If ENABLE_TRACING Then
                HMIRuntime.Trace "DiskMonitor: WARNING free space on " & _
                                 DRIVE_LETTER & " (" & _
                                 FormatNumber(pctFree, 2) & "% free)"
            End If
        End If
        HMIRuntime.Tags("DiskAlarmCrit_X").Write 0
        HMIRuntime.Tags("DiskAlarmWarn_X").Write 1
        HMIRuntime.Tags("DiskMonitorSts_X").Write 1   ' 1 = warning

    ElseIf pctFree > (WARN_PCT + HYSTERESIS_PCT) Then
        If HMIRuntime.Tags("DiskAlarmWarn_X").Read = 1 Or _
           HMIRuntime.Tags("DiskAlarmCrit_X").Read = 1 Then
            If ENABLE_TRACING Then
                HMIRuntime.Trace "DiskMonitor: CLEAR free space on " & _
                                 DRIVE_LETTER & " (" & _
                                 FormatNumber(pctFree, 2) & "% free)"
            End If
        End If
        HMIRuntime.Tags("DiskAlarmCrit_X").Write 0
        HMIRuntime.Tags("DiskAlarmWarn_X").Write 0
        HMIRuntime.Tags("DiskMonitorSts_X").Write 0   ' 0 = healthy
    End If
Else
    If ENABLE_TRACING Then
        HMIRuntime.Trace "DiskMonitor: Drive " & DRIVE_LETTER & " not ready"
    End If
    HMIRuntime.Tags("DiskMonitorSts_X").Write 3   ' 3 = drive not ready
End If

Set drive = Nothing
Set fso   = Nothing
On Error Goto 0

The five internal tags DiskPctFree_X, DiskMBFree_X, DiskAlarmWarn_X, DiskAlarmCrit_X, and DiskMonitorSts_X must be created in WinCC Tag Management. The binary tags are then bound to user-defined alarm messages in WinCC Alarm Logging (see the next section).

Workaround 1b — WinCC Tag Management Setup

Before the script can run, the tags must exist in the WinCC tag database. The setup procedure is:

1. In WinCC Explorer, right-click Tag Management and choose Open.
2. Right-click in the tag list and choose Add New Tag.
3. Create the five tags from the script header with the following properties:

   Tag Name	Data Type	Length	Initial Value	Purpose
   DiskPctFree_X	32-bit floating point	—	100.0	Live free percentage for trends
   DiskMBFree_X	32-bit floating point	—	0.0	Live free megabytes for trends
   DiskAlarmWarn_X	Binary	1 word	0	Bit 0 = warning state
   DiskAlarmCrit_X	Binary	1 word	0	Bit 0 = critical state
   DiskMonitorSts_X	Unsigned 16-bit	1 word	0	Status word: 0=ok, 1=warn, 2=crit, 3=not ready

4. Right-click the tag group and choose Properties to assign update cycle (recommended 60 s, matching the script schedule) and to enable archive logging for the trend tags.

Workaround 1c — WinCC Alarm Logging Configuration

The two binary tags need to be linked to operator-visible alarm messages.

1. In WinCC Explorer, open Alarm Logging.
2. Create a new message class LIC_HEALTH (license-partition health) to keep the new alarms separate from the built-in SYS_MON class.
3. Add a new message with message number 100001, text "Disk: License partition X below warning threshold ({PctFree}% free)", and a trigger tag of DiskAlarmWarn_X, bit 0, rising-edge trigger.
4. Add a new message with message number 100002, text "Disk: License partition X CRITICAL — archive or expand ({PctFree}% free)", and a trigger tag of DiskAlarmCrit_X, bit 0, rising-edge trigger.
5. Configure the message colors, priorities, and acknowledgment requirements per site procedure.
6. Open the AlarmControl on the operator screen and confirm both new messages appear in the LIC_HEALTH filter band.

Workaround 2 — Disabling the Built-In Free-Disk Alarm

If the custom percentage-based monitoring from Workaround 1 is accepted as the authoritative source, the nuisance built-in alarm can be suppressed. WinCC V6/V7 does not provide a UI to disable individual System Monitor counters, but the alarm can be hidden from the message configuration in two ways.

Method A — Alarm Logging message record

1. In WinCC Explorer, open Alarm Logging.
2. Locate the message class SYS_MON and the message text PERFMON: Free Megabytes on X:.
3. Set the Status property of the message to "Not displayed" — or remove the message from the active message configuration entirely.
4. Save the configuration and restart WinCC Runtime for the change to take effect.

Method B — AlarmControl filter

1. On the operator screen, open the configuration dialog of the WinCC AlarmControl control.
2. Add a message filter that excludes the text fragment PERFMON: Free Megabytes from the visible message list.
3. Confirm the filter does not unintentionally suppress other System Monitor messages (CPU, memory).

Workaround 3 — Increasing the Partition Capacity

The most defensible long-term solution is to size the partition correctly. A license-only partition of 2 GB will inevitably trip the percentage-based internal threshold over time. Use one of the following options:

• Move the license files to a larger volume and re-symlink the original location, then reformat X: as part of a larger partition. License files are typically C:\Program Files\Common Files\Siemens\Automation or C:\ProgramData\Siemens\Automation; verify the path on the specific installation before moving.
• Extend the volume in Windows Disk Management. Windows Server 2008 R2 and later support online extension for NTFS volumes, so a maintenance window may not be required.
• Re-partition the disk at the next maintenance window with a more realistic size — 20 GB minimum is recommended for license-only partitions, and 50 GB for archive partitions — and re-image the runtime station from the standard gold image.

This approach does not require any WinCC-side change and eliminates the false positive permanently. It is the recommended engineering solution for green-field installations and for stations that are still in the commissioning phase.

Workaround 4 — OS-Level Data Collector Set with Event Log Forwarding

For installations where the WinCC Runtime is not the only consumer of disk-space alarms, an OS-level PerfMon alert can be configured and forwarded into WinCC via the Windows Event Log. Microsoft's official Performance Monitor documentation describes the data collector set workflow and the alert task mechanism.

1. Open perfmon from the Start menu (right-click → Run as administrator).
2. Navigate to Data Collector Sets → User Defined.
3. Create a new data collector set with the LogicalDisk\Free Megabytes counter on instance X:.
4. Add an Alert Task with a manual threshold expressed as a fixed megabyte value. The alert writes to the Application event log with a configured event ID and message string.
5. On the WinCC station, configure an Event Log Monitor (WinCC V7+) that watches for that specific event ID and translates it into a WinCC alarm in a dedicated message class.

This approach gives full control over the threshold value and the timing of the alarm, but it does not directly map the threshold to a percentage within the PerfMon data collector — the percentage must be implemented either in the alert's response script (e.g. a VBScript that calculates the percent from the counter sample) or in the Event Log Monitor's interpretation logic. Refer to the Microsoft Learn Performance Monitor guide for the data collector set configuration workflow, and to the Dell support Performance Monitor best-practice note for a worked example of the alert task structure in a long-running service context.

Multiple-Drive Configuration

For stations that monitor more than one drive (e.g. C: for the OS, D: for the project database, X: for licenses), the custom VBScript from Workaround 1 can be parameterised with a small driver function and a tag array.

Sub MonitorDrive(letter, warnPct, alarmPct, hystPct)
    Dim fso, drv, pctFree
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set drv = fso.GetDrive(letter)
    If drv.IsReady Then
        pctFree = (drv.FreeSpace / drv.TotalSize) * 100
        HMIRuntime.Tags("DiskPctFree_" & letter).Write pctFree
        ' ... same threshold logic as Workaround 1 ...
    End If
    Set drv = Nothing
    Set fso = Nothing
End Sub

Call MonitorDrive("C:", 10, 5, 2)
Call MonitorDrive("D:", 15, 10, 3)
Call MonitorDrive("X:", 10, 5, 2)

Each drive gets its own tag group (DiskPctFree_C, DiskPctFree_D, DiskPctFree_X) and its own message class filter on the AlarmControl. The CPU cost scales linearly with the number of drives; for typical installations with three to five drives the overhead remains below 0.1% steady-state.

Verification

After applying any workaround, verify the change with the following checks. Each check has a specific pass criterion that must be met before the work-package can be closed.

1. Alarm Logging review (Runtime, 24-hour window). Confirm that the PERFMON: Free Megabytes on X: message either no longer appears (Workaround 2) or appears only when the actual free percentage is below the configured threshold (Workaround 1). Open WinCC Alarm Logging, set the filter to SYS_MON, and inspect the 24-hour statistics.
2. Tag trend validation. In WinCC Tag Logging Runtime, plot the DiskPctFree_X tag and confirm the values match the result of (free bytes / total bytes) × 100 calculated from Windows Explorer. A deviation greater than 0.1% indicates a calculation error in the script or a stale-counter issue.
3. Forced threshold test. Create a small test file on a test volume (do not perform this on the production X: license drive) that drives the free percentage below WARN_PCT, for example by filling a 10 GB test volume to 95% full. Confirm the custom alarm raises within one sample interval (60 s). Delete the test file and confirm the alarm clears within the hysteresis window.
4. CPU impact check. Open Windows Task Manager → Performance → CPU and confirm the new scheduled VBScript adds no measurable steady-state CPU load. Expected: below 0.1% on a modern multi-core server. If the CPU load is higher, increase the SAMPLE_INTERVAL from 60 s to 120 s.
5. Restart test. Restart the WinCC Runtime and confirm the custom script reschedules automatically and the percentage tags resume updating within 60 s of startup. If the script does not reschedule, check the WinCC Scheduler status dialog for an error code.
6. Operator acceptance. Walk the operator team through the new alarm and confirm they can distinguish the custom LIC_HEALTH alarm from the built-in SYS_MON alarm. Capture the operator sign-off in the commissioning record.

Best Practices

• Prefer percentage thresholds for variable-size volumes. Absolute MB thresholds are only meaningful when the drive size is known, stable, and large. License and archive partitions change size over the life of the system; percentage is the only sustainable metric.
• Document the alarm class mapping. If both the built-in SYS_MON alarm and a custom LIC_HEALTH alarm are present, the operator procedure must call out which one is the authoritative action trigger. A short note in the HMI operating manual is sufficient.
• Coordinate with Siemens Customer Support. Field experience shows the issue is escalated to a problem report rather than fixed in a hotfix. Filing the report at support.industry.siemens.com with a complete alarm log, the partition size, and the total WinCC version helps the product team prioritize a fix in a future service pack.
• Use Microsoft PerfMon for the underlying counter verification. The free megabytes counter is exposed by the Windows kernel; verify it with the official Microsoft tool rather than relying on WinCC's interpretation. See the Microsoft Learn Performance Monitor guide for the data collector set workflow and counter-interpretation rules.
• Reserve a dedicated alarm message class for license-partition health. Do not reuse the SYS_MON class for custom disk alarms. Use a new class (e.g. LIC_HEALTH) so that filtering on the WinCC AlarmControl can isolate license-partition events from CPU and memory events without losing visibility on the genuine resource alarms.
• Trend the percentage tag in WinCC Tag Logging. A historical record of free percentage over the past 30 days makes it easy to forecast when the partition will cross the warning threshold and schedule a maintenance window. Trend at the same 60 s cycle as the script for a clean correlation.
• Test the alarm on a non-production volume first. The forced-threshold test in the verification section should always be performed on a spare volume or a test rig, never on the production X: license drive. Writing test files to a license partition can trigger licensing issues that are far more disruptive than the original alarm.

Troubleshooting Matrix

FAQ