Jun 07 2018
12:13 AM
- last edited on
Apr 07 2022
05:10 PM
by
TechCommunityAP
Jun 07 2018
12:13 AM
- last edited on
Apr 07 2022
05:10 PM
by
TechCommunityAP
Hi,
I had an azure monitor query to alert on low disk space on the VMs, i want to modify it, but suddenly the query is not accepted, even if it is the same that was working.
here is the query and you can see in the screenshot the error,
Perf | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName != "_Total" | summarize AggregatedValue=arg_max(CounterValue,TimeGenerated,CounterName) by Computer, InstanceName , bin(TimeGenerated, 15m)
i tried using argmax instead of arg_max but no luck as well.
does anyone know how to get it working again ?
Jun 07 2018 01:39 AM
Hi,
you can try this one.
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| summarize FreeSpace = min(CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":"
| where FreeSpace < 15
| sort by FreeSpace asc
Jun 08 2018 05:23 AM
SolutionHi
Azure Log Analytics alerts will not work on aggregating more than one field. In your case you are aggregating by Computer and InstanceName. If you have configured such alert the alert will work by aggregating only the first filed and skip all the others that are not bin(). Basically your alert will not have the desired affect. I would guess they now have implemented this block on UI level to be clear for user of the service.
Jun 08 2018 05:23 AM
SolutionHi
Azure Log Analytics alerts will not work on aggregating more than one field. In your case you are aggregating by Computer and InstanceName. If you have configured such alert the alert will work by aggregating only the first filed and skip all the others that are not bin(). Basically your alert will not have the desired affect. I would guess they now have implemented this block on UI level to be clear for user of the service.