False alerts in SmartEvent GUI about low disk space on Security Gateway are generated in the following scenario:

1. In SmartDashboard:
   
   1. Open Security Management Server object - enable "SmartEvent" blade - click on OK
   2. Go to "Policy" menu - click on "Install Database..." - select all objects - click on OK
2. In SmartEvent GUI:
   
   1. Go to "Policy" tab - go to "Host Based Events" - enable "Low Disk Space" event
   2. Go to "Actions" menu - click on "Install Event Policy"
3. In SmartView Monitor:
   
   1. Go to "Gateways" menu - click on "Thresholds..."
   2. Enable "Free disk space" - set the desired value - click on OK
   3. Go to "Tools" menu - click on "Start System Alert Daemon"
4. In SmartEvent GUI:
   
   1. Go to "Events" tab
   2. Events appear that alert about low disk space on the involved Security Gateway, although there is enough free disk space available

False alerts in SmartView Monitor about low disk space on Security Gateway are generated in the following scenario:

1. Go to "Gateways" menu - click on "Thresholds..."
2. Enable "Free disk space" - set the desired value - click on OK
3. Go to "Tools" menu - click on "Start System Alert Daemon"
4. Go to "Tools" menu - click on "Alerts..."
5. Alerts appear about low disk space on the involved Security Gateway, although there is enough free disk space available

Debug of "cpstat_monitor" daemon (per sk108177) on Security Management Server shows that it receives information that free disk space is zero:

:DiskStat (
              :AdminInfo (
                :chkpf_uid ("{...}")
                :ClassName (os_disk_stat)
                :LastModified (
                  :Time ("DDD MMM  D HH:MM:SS YYY")
                  :last_modified_utc (...)
                  :By ()
                  :From ()
                )
              )
              :disk_percent_of_free_space (0)
            )
... ... ...
Exception  GW         cpshared_application_GW disk_space           [T] Free disk space on GW is less than 15% (currently 0%) DDD MMM  D HH:MM:SS YYY 2015

Debug of "FWM" daemon (per sk86186) on Security Management Server shows: