Identify the false alert source
The Windows disk plugin includes mounted ISO/DVD volumes in its disk measurements. The reported optical volume has fstype=CDFS, mode=ro, and a drive-letter device such as E:. Because this volume reports 100% used space, downstream alert logic can treat it as a full writable disk.
| Volume type | Observed filesystem | Observed mode | Required handling |
|---|---|---|---|
| Mounted ISO/DVD | CDFS |
ro |
Drop before collection |
| Normal Windows disk | NTFS |
rw or unknown
|
Retain |
Filter CDFS instead of allowing only NTFS
An NTFS-only filter avoids the immediate alert but defines permitted storage too narrowly. A tag-drop rule targets the observed unwanted class directly: measurements tagged fstype=CDFS. This also means every CDFS volume is excluded, not only ISO-backed volumes; use this rule only when CDFS capacity monitoring is unnecessary.
Configure the disk input tag drop
Add the filesystem tag-drop rule under the existing disk input configuration:
[[Inputs.disk]]
[inputs.disk.tagdrop]
fstype = ["CDFS"]This prevents matching measurements from being collected rather than suppressing their alerts later.
Verify the result
- Mount the ISO/DVD volume and confirm its disk measurement carries
fstype=CDFS. - Apply the tag-drop configuration and restart or reload the collector using the deployment's established procedure.
- Confirm that the CDFS measurement no longer appears while NTFS measurements remain available.
- Verify that the 100%-used alert no longer evaluates the excluded optical volume.
FAQ
How do I exclude mounted ISO drives from the Windows disk plugin?
Drop disk measurements whose fstype tag equals CDFS by configuring [inputs.disk.tagdrop] with fstype = ["CDFS"].
Why does a mounted ISO report 100% disk usage?
The observed mounted ISO/DVD volume is reported as a read-only CDFS filesystem and shows 100% used space, which can trigger ordinary disk-capacity alerts.
Will the CDFS tag-drop rule exclude physical DVD drives too?
The rule acts on the fstype=CDFS tag, not on how the volume was mounted. It therefore excludes every disk measurement carrying that tag.