# Capture Health Service metrics as timed snapshots, not historical trends

> What context should accompany a Storage Spaces Direct Health Service performance report?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-153-capture-health-service-metrics-as-timed-snapshots-not-historical-trends/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:14:38+00:00
- Modified: 2026-09-08T18:26:31+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

What context should accompany a Storage Spaces Direct Health Service performance report?

## Potentially affected

Use this review when collecting cluster metrics for an investigation or capacity discussion.

## DSE recommendation

Record timestamps and cluster membership with each captured report.

## Article

## Source facts

Microsoft’s Health Service reports provide live capacity and performance metrics aggregated across cluster nodes, with membership detection. The values represent the point in time at which they are collected. The documented object model distinguishes the storage subsystem, nodes, data volumes, and Health Service. Its streaming example receives successive metric samples and handles the end of the stream separately. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/failover-clustering/health-service-reports).

## Applicability

Use this review when collecting cluster metrics for an investigation or capacity discussion. Identify the cluster, requested objects, sampling time, and workload conditions. Decide whether a single observation or a retained sequence is needed.

## DSE recommendation

Record timestamps and cluster membership with each captured report. Select a consistent observation interval when the question concerns change over time, and arrange an approved destination for retained samples. Ask the storage owner to define the workload context needed to interpret the values. Keep a missing sample distinguishable from a measured low value in the record.

## Verification

Compare repeated observations collected under the agreed method and verify that they refer to the intended cluster and volumes. Check the handling of an interrupted collection session rather than assuming continuous coverage. Document gaps, membership changes, and workload differences alongside any conclusion. Preserve the original samples so a later reviewer can separate observations from interpretation.

## Official references

[Microsoft Learn: Health Service reports](https://learn.microsoft.com/en-us/windows-server/failover-clustering/health-service-reports). Source reviewed September 8, 2026.

## Primary reference

- Name: Health Service reports
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/failover-clustering/health-service-reports
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Capture Health Service metrics as timed snapshots, not historical trends,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-153-capture-health-service-metrics-as-timed-snapshots-not-historical-trends/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.