I want see an alert when my disk space less than 5Gb in virtual machine.

Copper Contributor

I want see an alert when my disk space less than 5Gb in virtual machine. Please provide the steps that need to be configured. I want to get the email notification when my VM disk space less than 5GB.

 

 

7 Replies

@kasunth look for the example query in the Logs blade.  Type in "free disk" to find a suitable query (or look at others)Screenshot 2021-03-17 111959.jpg
It tells you the next step, which is  - 'To create an alert for this query, click '+ New alert rule'' - see here 
Create, view, and manage activity log alerts in Azure Monitor - Azure Monitor | Microsoft Docs


Hello @kasunth,

 

Below is an instruction on how to create an alert based on custom log:

1. Go to Alerts Panel and click on "Manage Actions".

obakun_0-1616750398530.png

2. Create Action Group for your destination email address(here is a link with instruction about how to create action group: How to create action group).

3. Back to Alerts Panel and click "Mange alert rules".

4. Click "New alert rule".

obakun_1-1616750508875.png

5. As a Scope, select Log Analytics Workspace that contains logs related to Free Disk Space.

obakun_2-1616750903157.png

obakun_3-1616750921918.png

6. In Condition area, click "Add condition", as signal type choose "Log" and then choose "Custom log search".

obakun_4-1616750971231.png

7. Copy query below and past into "Search query" area:

let PercentSpace = 10;
Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
or ObjectName == "Logical Disk" and CounterName == "% Free Space"
| where InstanceName != "D:"
| summarize FreeSpace = avg(CounterValue) by Computer, InstanceName
| where InstanceName contains ":" or InstanceName == "/"
| where FreeSpace < PercentSpace

8. Set alert logic as on screenshot below and click "Done":

obakun_5-1616751369125.png

9.In Action area, add Action Group that you have created in step 2.

obakun_7-1616751679904.png

 

10. Customize your alert like on example below:

obakun_6-1616751572976.png

11. Click "Save".

12. Enable your alert and that's all.

@oleksand_bakun 


After migration to AMA, this query doesn't work for my dashboard anymore

Perf
| where TimeGenerated > ago(15minutes)
| where ObjectName == "Logical Disk" or ObjectName == "LogicalDisk"
| where CounterName == "% Free Space"
| where InstanceName <> "_Total" and InstanceName !contains "HarddiskVolume"
| summarize AggregatedValue = avg(CounterValue) by Computer, InstanceName
| where AggregatedValue <= 22
//| top 10 by AggregatedValue
| order by AggregatedValue asc

 

any clue(s)?

Do i need to add anything to my perf count on DCR or diag the vms

@sparkislife I've run a query very similar to yours and have had no trouble.

let PercentSpace = 20;
Perf
| where ObjectName == "Logical Disk" // the object name used in Linux records
| where CounterName == "% Free Space"
| where TimeGenerated > ago(1h)
| where InstanceName <> "_Total" and InstanceName !contains "HarddiskVolume"
| summarize FreeSpace = avg(CounterValue) by Computer, InstanceName
| where FreeSpace < PercentSpace
| order by FreeSpace asc

 

I wonder if you'd consider splitting up the where clause with InstanceName, or removing it completely perhaps to see if that has any expected output?

The AMA writes to the insightmetrics or at least mine is.
This is what my query looks like for disk space
let availpercent = 10;
InsightsMetrics
| where Origin == "vm.azm.ms"
and Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"
| extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"])
| summarize Disk_Free_Space = avg(Val) by Computer, Disk, _ResourceId
| project Computer, Disk, Disk_Free_Space
| where Disk_Free_Space < availpercent

You might want to try that.
Any of you guys why when I run these same queries I get zero results. Its suggests to expand the date time which I have to max and still get zero results.

What else required to get these logs?
If you are looking for the VM data, ensure that you have the agent extension on your VM check that AzureMonitorWindowsAgent (if its a windows box) is on the host as an extension.

Second ensure that you have created a Data Collection Rule and it has your VMs listed as a source and the Data Source is performance counters and is pointed to your Log Analytic Workspace