{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/", "slug": "dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary", "url": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/" }, "title": "Interpret S2D drive history at the device measurement boundary", "summary": "Which parts of the I/O path are represented by Storage Spaces Direct drive-history counters?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:13:56+00:00", "modified_at": "2026-09-08T18:26:32+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 204, "potentially_affected": "Administrators interpreting physical-drive performance history in Storage Spaces Direct.", "dse_recommendation": "Record the drive identity and measurement boundary alongside each performance finding.", "primary_source": { "name": "Performance history for drives", "url": "https://learn.microsoft.com/en-us/windows-server/storage/storage-spaces/performance-history-for-drives", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft provides drive history for devices in the cluster storage subsystem, excluding operating-system boot drives. The IOPS, throughput, and latency series come from the connected server’s Physical Disk counters, measured by partmgr.sys. They exclude much of the Windows software stack and network traversal. The values cover the whole interval: Microsoft’s example averages thirty operations in a ten-second interval as three operations per second. Microsoft documentation.

\n

Applicability

\n

Identify the physical drive, connected server, metric, time interval, and application event. Distinguish the device-level observation from an end-to-end application response measurement before attributing a delay.

\n

DSE recommendation

\n

Record the drive identity and measurement boundary alongside each performance finding. Correlate device observations with workload and network evidence from the same period. Ask the investigator to state whether a value is an interval average or another aggregation before comparing it with a threshold.

\n

Verification

\n

Check the requested drive’s series and timestamps and compare them with the planned measurement interval. Investigate a high device latency alongside the remaining I/O path rather than assigning the whole application delay to that drive. Preserve missing history or an excluded boot device as a scope limitation.

\n

Official references

\n

Microsoft Learn: Performance history for drives. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft provides drive history for devices in the cluster storage subsystem, excluding operating-system boot drives. The IOPS, throughput, and latency series come from the connected server’s Physical Disk counters, measured by partmgr.sys. They exclude much of the Windows software stack and network traversal. The values cover the whole interval: Microsoft’s example averages thirty operations in a ten-second interval as three operations per second. Microsoft documentation.\nApplicability\nIdentify the physical drive, connected server, metric, time interval, and application event. Distinguish the device-level observation from an end-to-end application response measurement before attributing a delay.\nDSE recommendation\nRecord the drive identity and measurement boundary alongside each performance finding. Correlate device observations with workload and network evidence from the same period. Ask the investigator to state whether a value is an interval average or another aggregation before comparing it with a threshold.\nVerification\nCheck the requested drive’s series and timestamps and compare them with the planned measurement interval. Investigate a high device latency alongside the remaining I/O path rather than assigning the whole application delay to that drive. Preserve missing history or an excluded boot device as a scope limitation.\nOfficial references\nMicrosoft Learn: Performance history for drives. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft provides drive history for devices in the cluster storage subsystem, excluding operating-system boot drives. The IOPS, throughput, and latency series come from the connected server’s Physical Disk counters, measured by partmgr.sys. They exclude much of the Windows software stack and network traversal. The values cover the whole interval: Microsoft’s example averages thirty operations in a ten-second interval as three operations per second. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/storage/storage-spaces/performance-history-for-drives).\n\n## Applicability\n\nIdentify the physical drive, connected server, metric, time interval, and application event. Distinguish the device-level observation from an end-to-end application response measurement before attributing a delay.\n\n## DSE recommendation\n\nRecord the drive identity and measurement boundary alongside each performance finding. Correlate device observations with workload and network evidence from the same period. Ask the investigator to state whether a value is an interval average or another aggregation before comparing it with a threshold.\n\n## Verification\n\nCheck the requested drive’s series and timestamps and compare them with the planned measurement interval. Investigate a high device latency alongside the remaining I/O path rather than assigning the whole application delay to that drive. Preserve missing history or an excluded boot device as a scope limitation.\n\n## Official references\n\n[Microsoft Learn: Performance history for drives](https://learn.microsoft.com/en-us/windows-server/storage/storage-spaces/performance-history-for-drives). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/", "url": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Interpret S2D drive history at the device measurement boundary", "item": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/", "url": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/", "headline": "Interpret S2D drive history at the device measurement boundary", "description": "Which parts of the I/O path are represented by Storage Spaces Direct drive-history counters?", "abstract": "Which parts of the I/O path are represented by Storage Spaces Direct drive-history counters?", "articleBody": "Source facts\nMicrosoft provides drive history for devices in the cluster storage subsystem, excluding operating-system boot drives. The IOPS, throughput, and latency series come from the connected server’s Physical Disk counters, measured by partmgr.sys. They exclude much of the Windows software stack and network traversal. The values cover the whole interval: Microsoft’s example averages thirty operations in a ten-second interval as three operations per second. Microsoft documentation.\nApplicability\nIdentify the physical drive, connected server, metric, time interval, and application event. Distinguish the device-level observation from an end-to-end application response measurement before attributing a delay.\nDSE recommendation\nRecord the drive identity and measurement boundary alongside each performance finding. Correlate device observations with workload and network evidence from the same period. Ask the investigator to state whether a value is an interval average or another aggregation before comparing it with a threshold.\nVerification\nCheck the requested drive’s series and timestamps and compare them with the planned measurement interval. Investigate a high device latency alongside the remaining I/O path rather than assigning the whole application delay to that drive. Preserve missing history or an excluded boot device as a scope limitation.\nOfficial references\nMicrosoft Learn: Performance history for drives. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:13:56+00:00", "dateModified": "2026-09-08T18:26:32+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-195-interpret-s2d-drive-history-at-the-device-measurement-boundary/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Interpret S2D drive history at the device measurement boundary" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 204, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Performance history for drives", "url": "https://learn.microsoft.com/en-us/windows-server/storage/storage-spaces/performance-history-for-drives" } } ] } }