Forum Discussion

Copper Contributor

Jul 28, 2021

Solved

Assistance with Log Analytics Disk Query

Good Morning all, I'm hoping to get some help with log analytics, I'm trying to write a simple query that returns the percentage of used disk space for both Windows and Linux VMs. For Linux V...

azure monitor

CliveWatson

Jul 29, 2021

Hairy_Zeus

Maybe this?

Perf
//| where Computer !startswith "A" //or Computer startswith "J" //testing
| where TimeGenerated > startofday(ago(1d))
| where CounterName in ( "% Free Space" , "% Used Space", "Free Megabytes")
| where InstanceName !contains 'Harddisk' and InstanceName != '_Total'
| summarize PctFree=avgif(CounterValue, CounterName == "% Free Space" ), 
            Linux  =avgif(CounterValue, CounterName == "% Used Space"), 
            MbFree =avgif(CounterValue, CounterName == "Free Megabytes"),
            arg_max(TimeGenerated, Computer) by Computer, InstanceName 
| extend PctFree = iif(isnan(PctFree),Linux,PctFree)
| project-away Linux, Computer1
| project TotalSizeGB=round(MbFree*100/PctFree/1024,0), 
            round(PctFree,2),
            round(MbFree,2), 
            Computer, 
            InstanceName
| summarize FreePCT=avg(PctFree) by Computer,
            InstanceName,
            TotalSizeGB,
            FreeGB = round(MbFree / 1024,2)
| sort by Computer asc, InstanceName asc
| project Computer, InstanceName, TotalSizeGB, FreeGB,  GBinUse = TotalSizeGB - FreeGB, FreePCT

Hairy_Zeus

Copper Contributor

Jul 29, 2021

CliveWatson thanks for the reply, much appreciated. This is perfect for Windows servers but it doesn't look like it's pulling any data for Linux servers, any idea how I can pull the same data in the same query for Linux servers also?

CliveWatson

Former Employee

Jul 29, 2021

Hairy_Zeus

Maybe this?

Perf
//| where Computer !startswith "A" //or Computer startswith "J" //testing
| where TimeGenerated > startofday(ago(1d))
| where CounterName in ( "% Free Space" , "% Used Space", "Free Megabytes")
| where InstanceName !contains 'Harddisk' and InstanceName != '_Total'
| summarize PctFree=avgif(CounterValue, CounterName == "% Free Space" ), 
            Linux  =avgif(CounterValue, CounterName == "% Used Space"), 
            MbFree =avgif(CounterValue, CounterName == "Free Megabytes"),
            arg_max(TimeGenerated, Computer) by Computer, InstanceName 
| extend PctFree = iif(isnan(PctFree),Linux,PctFree)
| project-away Linux, Computer1
| project TotalSizeGB=round(MbFree*100/PctFree/1024,0), 
            round(PctFree,2),
            round(MbFree,2), 
            Computer, 
            InstanceName
| summarize FreePCT=avg(PctFree) by Computer,
            InstanceName,
            TotalSizeGB,
            FreeGB = round(MbFree / 1024,2)
| sort by Computer asc, InstanceName asc
| project Computer, InstanceName, TotalSizeGB, FreeGB,  GBinUse = TotalSizeGB - FreeGB, FreePCT

Hairy_Zeus
Copper Contributor
Jul 29, 2021
This is exactly what I was looking for, you're a life saver. Thank you very much!