Forum Discussion
I want see an alert when my disk space less than 5Gb in virtual machine.
Hello kasunth,
Below is an instruction on how to create an alert based on custom log:
1. Go to Alerts Panel and click on "Manage Actions".
2. Create Action Group for your destination email address(here is a link with instruction about how to create action group: https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups#create-the-action-group).
3. Back to Alerts Panel and click "Mange alert rules".
4. Click "New alert rule".
5. As a Scope, select Log Analytics Workspace that contains logs related to Free Disk Space.
6. In Condition area, click "Add condition", as signal type choose "Log" and then choose "Custom log search".
7. Copy query below and past into "Search query" area:
let PercentSpace = 10;
Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
or ObjectName == "Logical Disk" and CounterName == "% Free Space"
| where InstanceName != "D:"
| summarize FreeSpace = avg(CounterValue) by Computer, InstanceName
| where InstanceName contains ":" or InstanceName == "/"
| where FreeSpace < PercentSpace8. Set alert logic as on screenshot below and click "Done":
9.In Action area, add Action Group that you have created in step 2.
10. Customize your alert like on example below:
11. Click "Save".
12. Enable your alert and that's all.
After migration to AMA, this query doesn't work for my dashboard anymore
Perf
| where TimeGenerated > ago(15minutes)
| where ObjectName == "Logical Disk" or ObjectName == "LogicalDisk"
| where CounterName == "% Free Space"
| where InstanceName <> "_Total" and InstanceName !contains "HarddiskVolume"
| summarize AggregatedValue = avg(CounterValue) by Computer, InstanceName
| where AggregatedValue <= 22
//| top 10 by AggregatedValue
| order by AggregatedValue asc
any clue(s)?
Do i need to add anything to my perf count on DCR or diag the vms
- The AMA writes to the insightmetrics or at least mine is.
This is what my query looks like for disk space
let availpercent = 10;
InsightsMetrics
| where Origin == "vm.azm.ms"
and Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"
| extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"])
| summarize Disk_Free_Space = avg(Val) by Computer, Disk, _ResourceId
| project Computer, Disk, Disk_Free_Space
| where Disk_Free_Space < availpercent
You might want to try that.- Any of you guys why when I run these same queries I get zero results. Its suggests to expand the date time which I have to max and still get zero results.
What else required to get these logs?- If you are looking for the VM data, ensure that you have the agent extension on your VM check that AzureMonitorWindowsAgent (if its a windows box) is on the host as an extension.
Second ensure that you have created a Data Collection Rule and it has your VMs listed as a source and the Data Source is performance counters and is pointed to your Log Analytic Workspace
sparkislife I've run a query very similar to yours and have had no trouble.
let PercentSpace = 20; Perf | where ObjectName == "Logical Disk" // the object name used in Linux records | where CounterName == "% Free Space" | where TimeGenerated > ago(1h) | where InstanceName <> "_Total" and InstanceName !contains "HarddiskVolume" | summarize FreeSpace = avg(CounterValue) by Computer, InstanceName | where FreeSpace < PercentSpace | order by FreeSpace ascI wonder if you'd consider splitting up the where clause with InstanceName, or removing it completely perhaps to see if that has any expected output?
