Query How to find disk free space in % in LINUX VM's

[Alex Kobin]

Hi everyone

I'm looking for a query that will show me a free disk space in % in Linux VM's.

For now i got a query that suppose to show me what i need but the results is wrong for LINUX VM's.

So i wonder maybe someone got this done before and got a query for this, or what is wrong in my query?

Perf

| where TimeGenerated > ago(5m)

| where ((ObjectName == "LogicalDisk" and CounterName == "% Free Space") or (ObjectName == "Logical Disk" and CounterName == "% Used Space"))

| summarize (TimeGenerated, Free_Space_Percent)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName

[#2 · Accepted solution]

Hi,

Indeed,"% Free Space" is a performance log sent from Windows. Linux is reporting "% Used space" instead, and unfortunately the object name is slightly different (with space), try this:

Perf 
| where ObjectName == "Logical Disk" and CounterName == "% Used Space" 
| summarize arg_max(TimeGenerated, *) by Computer

The 'arg_max' line is optional. I used it to return only the latest report per computer. Note this is the percent of used space, if you need free space you add this line:

| extend free_space=100-CounterValue

and the calculated value would appear as the right-most column on the results table.

HTH,

Noa

[#3]

Hi Noa,

I have tried below query  but i am getting data C drive

Perf

| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName == "C:" 

| summarize arg_max(TimeGenerated, *) by Computer

But when i am trying to get data for all drives i am only getting for F:, Z:, H:, E: drive. Its strange that i am not getting for data for C: drive and other some drives. do not know why?

Perf

| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName contains ":"

| summarize arg_max(TimeGenerated, *) by Computer

[#4]

Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| summarize arg_max(TimeGenerated, CounterValue) by Computer, InstanceName

arg_max was returning only a instance (the one with the most recent value) per computer in the form you used it in your question.

the query above will give you the most recent %Free for every logical disk.