Forum Discussion
Help with Disk query in Log Analytics
Hi Rajinder Rahul,
Your question is very popular, indeed many times users want to get the latest report of a computer performance counter (such as free space). Note that the overall size of the disk is not reported AFAIK but the free percent of it and free MB are.
First, I highly recommend to start with the table name (Perf), to avoid unneeded search of the entire DB.
To get the latest report I suggest using "arg_max", which would be more accurate than "summarize min". "arg_max" is intended exactly to return the the record that has a maximum value, in this case the record with the maximum TimeGenerated (meaning it is the latest record found). For example:
Perf | where TimeGenerated > ago(1d) | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" | summarize (TimeGenerated, Free_Space_Percent)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName | where strlen(InstanceName) ==2 and InstanceName contains ":"
The above example will returns the maximum free space percent for each computer and instance:
The same can be done for free MB.
To combine the results of both calculations I recommend using "Join", which lets you match results by computer and instance names. See the join example here.
The results look like this:
HTH,
Noa
How to check the disk failure in log analytics
Rajinder Rahul wrote:Hi
I was wondering if I could get some help with Log analytics. New to this so bear with me.
I'm trying to create a query that will provide informtaion on disk utilisation in Azure. I've gottwo commands (below), however I'm not able to merge them as I would like one query which gives me % free space, overall size of disk, name of vm and name of disk. Anything else I can get in terms of disk usage would be great, not overly concerned with IOPs at the moment.
The commands are:
Thsi proivides info on free space:
search ObjectName == "LogicalDisk" and CounterName == "% Free Space"
This one provides information on free Mb remaining.
search ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"
I have tried this which helps, but again information is quite limited
search ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" and TimeGenerated > ago(1d)
| summarize FreeSpace = min(CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":"
Thanks in advance :)
I am Trying to create query for the disk IOPS and below is the query, I was getting data but i am not sure whether this the correct one to monitor the disk IOPS
Can someone have a quick look and respond 🙂
Perf
| where ObjectName == "LogicalDisk" and CounterName == "Disk Transfers/sec" and InstanceName != "_Total" and InstanceName !contains "HarddiskVolume"
| summarize IopsAvg = avg(CounterValue), IopsMax = max(CounterValue) by InstanceName,Computer
| project Computer,InstanceName,IopsAvg,IopsMax