How to validate DBSS - Log Files Utilization alarm for tempdb (4382213)

Users receive repeated DBSS - Log Files Utilization alarms for a SQL Server database (including tempdb) and question whether the alarms are valid, especially when the condition appears to have self-resolved.

The alarm evaluates file_group_utilization (= file_used_MB / total_MB × 100) collected by the DBSS_File_Group collection every 15 minutes. It is data-driven with no sustained-duration condition, a single sample above threshold fires the alarm immediately.

Default collection frequencies for DBSS_File_Group (adjustable in the Database Agent's Administration panel):

Note: the minimum collection frequency for DBSS_File_Group is 15 minutes in all online modes. A log spike that occurs and resolves between two collection cycles will appear as a single alarm event rather than multiple consecutive ones.

Default thresholds: Warning = 70%, Critical = 80%, Fatal = 90%.

Because tempdb uses SIMPLE recovery, the log self-truncates at checkpoint. A spike that resolves between collection cycles is still a valid alarm, the log genuinely reached that level during the collection interval.

1. Confirm validity: Look at the file_group_utilization history in the Foglight topology. For data older than 3 days (which uses 4-hour rollup buckets), compare the max value in the bucket covering the alarm timestamp against the alarm-reported percentage.

2. Check if sustained: Multiple alarm events across consecutive 15-minute windows indicate a sustained condition; a single event indicates a brief spike.

3. Identify the cause: Use SQL PI for the same instance/time window to identify sessions with open transactions in tempdb, WRITELOG waits, or top SQL by tempdb usage.

4. Reduce noise if expected: Raise thresholds in the alarm template or apply a blackout schedule during known maintenance windows.

5. Fix in SQL Server: Tune workloads causing large tempdb log allocations, or increase tempdb log file size/auto-growth limits.