SOLVED

Query How to find disk free space in % in LINUX VM's

%3CLINGO-SUB%20id%3D%22lingo-sub-229318%22%20slang%3D%22en-US%22%3EQuery%20How%20to%20find%20disk%20free%20space%20in%20%25%20in%20LINUX%20VM's%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-229318%22%20slang%3D%22en-US%22%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EHi%20everyone%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EI'm%20looking%20for%20a%20query%20that%20will%20show%20me%20a%20free%20disk%20space%20in%20%25%20in%20Linux%20VM's.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EFor%20now%20i%20got%20a%20query%20that%20suppose%20to%20show%20me%20what%20i%20need%20but%20the%20results%20is%20wrong%20for%20LINUX%20VM's.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ESo%20i%20wonder%20maybe%20someone%20got%20this%20done%20before%20and%20got%20a%20query%20for%20this%2C%20or%20what%20is%20wrong%20in%20my%20query%3F%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EPerf%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20TimeGenerated%20%26gt%3B%20ago(%3C%2FSPAN%3E%3CSPAN%3E5%3C%2FSPAN%3E%3CSPAN%3Em)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20((ObjectName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22LogicalDisk%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Free%20Space%22%3C%2FSPAN%3E%3CSPAN%3E)%20%3C%2FSPAN%3E%3CSPAN%3Eor%3C%2FSPAN%3E%3CSPAN%3E%20(ObjectName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Logical%20Disk%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Used%20Space%22%3C%2FSPAN%3E%3CSPAN%3E))%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20(TimeGenerated%2C%20Free_Space_Percent)%3Darg_max(TimeGenerated%2C%20CounterValue)%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20Computer%2C%20InstanceName%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-229318%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-241921%22%20slang%3D%22en-US%22%3ERe%3A%20Query%20How%20to%20find%20disk%20free%20space%20in%20%25%20in%20LINUX%20VM's%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-241921%22%20slang%3D%22en-US%22%3E%3CDIV%3E%3CPRE%3E%3CSPAN%3EPerf%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20ObjectName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22LogicalDisk%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Free%20Space%22%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20arg_max(TimeGenerated%2C%20CounterValue)%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20Computer%2C%20InstanceName%3C%2FSPAN%3E%3C%2FPRE%3E%3CP%3Earg_max%20was%20returning%20only%20a%20instance%20(the%20one%20with%20the%20most%20recent%20value)%20per%20computer%20in%20the%20form%20you%20used%20it%20in%20your%20question.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethe%20query%20above%20will%20give%20you%20the%20most%20recent%20%25Free%20for%20every%20logical%20disk.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-241142%22%20slang%3D%22en-US%22%3ERe%3A%20Query%20How%20to%20find%20disk%20free%20space%20in%20%25%20in%20LINUX%20VM's%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-241142%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Noa%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20tried%20below%20query%26nbsp%3B%20but%20i%20am%20getting%20data%20C%20drive%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EPerf%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20ObjectName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22LogicalDisk%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Free%20Space%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3BInstanceName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22C%3A%22%3C%2FSPAN%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20arg_max(TimeGenerated%2C%20*)%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20Computer%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20when%20i%20am%20trying%20to%20get%20data%20for%20all%20drives%20i%20am%20only%20getting%20for%20F%3A%2C%20Z%3A%2C%20H%3A%2C%20E%3A%20drive.%20Its%20strange%20that%20i%20am%20not%20getting%20for%20data%20for%20C%3A%20drive%20and%20other%20some%20drives.%20do%20not%20know%20why%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EPerf%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20ObjectName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22LogicalDisk%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Free%20Space%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%20%3CSPAN%3EInstanceName%20%3C%2FSPAN%3E%3CSPAN%3Econtains%3C%2FSPAN%3E%20%3CSPAN%3E%22%3A%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20arg_max(TimeGenerated%2C%20*)%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20Computer%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-234219%22%20slang%3D%22en-US%22%3ERe%3A%20Query%20How%20to%20find%20disk%20free%20space%20in%20%25%20in%20LINUX%20VM's%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-234219%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3EIndeed%2C%22%25%20Free%20Space%22%20is%20a%20performance%20log%20sent%20from%20Windows.%20Linux%20is%20reporting%20%22%25%20Used%20space%22%20instead%2C%20and%20unfortunately%20the%20object%20name%20is%20slightly%20different%20(with%20space)%2C%20try%20this%3A%3C%2FP%3E%0A%3CPRE%3EPerf%20%0A%7C%20where%20ObjectName%20%3D%3D%20%22Logical%20Disk%22%20and%20CounterName%20%3D%3D%20%22%25%20Used%20Space%22%20%0A%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%3C%2FPRE%3E%0A%3CP%3EThe%20'arg_max'%20line%20is%20optional.%20I%20used%20it%20to%20return%20only%20the%20latest%20report%20per%20computer.%20Note%20this%20is%20the%20percent%20of%20used%20space%2C%20if%20you%20need%20free%20space%20you%26nbsp%3Badd%20this%20line%3A%3C%2FP%3E%0A%3CPRE%3E%7C%20extend%20free_space%3D100-CounterValue%3C%2FPRE%3E%0A%3CP%3Eand%20the%20calculated%20value%20would%20appear%20as%20the%20right-most%20column%20on%20the%20results%20table.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHTH%2C%3C%2FP%3E%0A%3CP%3ENoa%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor
Hi everyone
I'm looking for a query that will show me a free disk space in % in Linux VM's.
For now i got a query that suppose to show me what i need but the results is wrong for LINUX VM's.
So i wonder maybe someone got this done before and got a query for this, or what is wrong in my query?
 
Perf
| where TimeGenerated > ago(5m)
| where ((ObjectName == "LogicalDisk" and CounterName == "% Free Space") or (ObjectName == "Logical Disk" and CounterName == "% Used Space"))
| summarize (TimeGenerated, Free_Space_Percent)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName
3 Replies
Best Response confirmed by Stanislav Zhelyazkov (MVP)
Solution

Hi,

Indeed,"% Free Space" is a performance log sent from Windows. Linux is reporting "% Used space" instead, and unfortunately the object name is slightly different (with space), try this:

Perf 
| where ObjectName == "Logical Disk" and CounterName == "% Used Space" 
| summarize arg_max(TimeGenerated, *) by Computer

The 'arg_max' line is optional. I used it to return only the latest report per computer. Note this is the percent of used space, if you need free space you add this line:

| extend free_space=100-CounterValue

and the calculated value would appear as the right-most column on the results table.

 

HTH,

Noa

Hi Noa,

 

I have tried below query  but i am getting data C drive

 

Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName == "C:" 
| summarize arg_max(TimeGenerated, *) by Computer

 

 

But when i am trying to get data for all drives i am only getting for F:, Z:, H:, E: drive. Its strange that i am not getting for data for C: drive and other some drives. do not know why?

 

Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName contains ":"
| summarize arg_max(TimeGenerated, *) by Computer
Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| summarize arg_max(TimeGenerated, CounterValue) by Computer, InstanceName

arg_max was returning only a instance (the one with the most recent value) per computer in the form you used it in your question.

 

the query above will give you the most recent %Free for every logical disk.