wmic logicaldisk where name="c:" get freespace, size Then you'd have to compare the results...
The output looks like this: C:\>wmic logicaldisk where name="c:" get freespace, size FreeSpace Size 16238436352 80024170496 If C: isn't the proper system root, then try wmic logicaldisk where name="%systemdrive%" get freespace, size >From that point I don't know how to get OSSEC to parse the data but it's the easiest method I can think of to grab the data. -rich
