Forum Discussion
Help with making the query work
Meir_Mendelovich Thanks, another query question to ask
Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and Computer != "net-fs3.networkhg.org.uk" and Computer != "NET-FS1.networkhg.org.uk" and Computer != "NET-SQL3.networkhg.org.uk" and Computer != "NET-EDMLIVEDB1.networkhg.org.uk" and Computer != "NET-EDM_KOFAX1.networkhg.org.uk"
| summarize Free_Space = min(CounterValue) by Computer, InstanceName
| where strlen(InstanceName) == 2 and InstanceName contains ":" and Computer != "NET-REPAIR2.networkhg.org.uk" and InstanceName !contains ":E" and Computer != "NH-E2016-01.networkhg.org.uk" and InstanceName !contains ":E" and Computer != "NH-E2016-02.networkhg.org.uk" and InstanceName !contains ":E" and Computer != "net-boxi1.networkhg.org.uk" and InstanceName !contains ":D"
| where Free_Space < 10
How can I make this more readable , also make sure that one instance for that computer Is not being monitored instead of all
FYI, this was answered on this group: https://techcommunity.microsoft.com/t5/azure/assiatnce-with-kql-disk-space-high-alert/m-p/1468547#M5458
- Arslan11Jun 25, 2020Copper Contributor
I need assistance with amending the query further and make it more automated. I would like to avoid another computer within this command, for instance G drive and I want this to be monitored for less then 6 %
Is it possible to be done within the same query
- CliveWatsonJun 26, 2020Former Employee
Hi Arslan11
You may get a faster response if you don't ask me directly (I'm often busy with my job, and look here infrequently at times) also others may have alternative ideas and methods to share.
Anyway, you can probably achieve the outcome with this, I've added a capacity case statement, that allows for a specific computer and drive letter size, plus a default option for the unspecified computers :Perf // set up filters | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" | where strlen(InstanceName) == 2 and InstanceName contains ":" // exclude ALL these named computers | where Computer !in ("net-fs3.networkhg.org.uk","NET-FS1.networkhg.org.uk","NET-SQL3.networkhg.org.uk", "NET-EDMLIVEDB1.networkhg.org.uk","NET-EDM_KOFAX1.networkhg.org.uk") // Show all | summarize Free_Space = min(CounterValue) by Computer , InstanceName // Exclude these drive / Computer combinations // Use a "1" to denaote an exclude else "0" | extend ComputerList = case( Computer == "NET-REPAIR2.networkhg.org.uk" and InstanceName == "E:",1, Computer == "NH-E2016-01.networkhg.org.uk" and InstanceName == "E:",1, Computer == "NH-E2016-02.networkhg.org.uk" and InstanceName == "E:",1, Computer == "net-boxi1.networkhg.org.uk" and InstanceName == "D:",1, // Computer == "NET-SQL2" and InstanceName == "G:",1, Computer == "RETAILVM01" and InstanceName == "D:",1, //else zero 0) | where Computer startswith "R" or Computer startswith "SQL" | where ComputerList !=1 // Set a required capacity for a specifc computer and drive letter or use a default value like 10% | extend driveCapacityFilter = case( Computer == "NET-SQL2" and InstanceName == "G:", 6, // Computer == "RETAILVM01" and InstanceName == "G:", 80, // else use default value i.e.10% 10) | where Free_Space < driveCapacityFilter | project-away ComputerList
- Arslan11Jun 26, 2020Copper Contributor
CliveWatson Plus, I tested the query, it is working according to my need