Query How to find disk free space in % in LINUX VM's

Occasional Contributor
Hi everyone
I'm looking for a query that will show me a free disk space in % in Linux VM's.
For now i got a query that suppose to show me what i need but the results is wrong for LINUX VM's.
So i wonder maybe someone got this done before and got a query for this, or what is wrong in my query?
| where TimeGenerated > ago(5m)
| where ((ObjectName == "LogicalDisk" and CounterName == "% Free Space") or (ObjectName == "Logical Disk" and CounterName == "% Used Space"))
| summarize (TimeGenerated, Free_Space_Percent)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName
3 Replies
best response confirmed by Stanislav Zhelyazkov (MVP)


Indeed,"% Free Space" is a performance log sent from Windows. Linux is reporting "% Used space" instead, and unfortunately the object name is slightly different (with space), try this:

| where ObjectName == "Logical Disk" and CounterName == "% Used Space" 
| summarize arg_max(TimeGenerated, *) by Computer

The 'arg_max' line is optional. I used it to return only the latest report per computer. Note this is the percent of used space, if you need free space you add this line:

| extend free_space=100-CounterValue

and the calculated value would appear as the right-most column on the results table.




Hi Noa,


I have tried below query  but i am getting data C drive


| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName == "C:" 
| summarize arg_max(TimeGenerated, *) by Computer



But when i am trying to get data for all drives i am only getting for F:, Z:, H:, E: drive. Its strange that i am not getting for data for C: drive and other some drives. do not know why?


| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName contains ":"
| summarize arg_max(TimeGenerated, *) by Computer
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| summarize arg_max(TimeGenerated, CounterValue) by Computer, InstanceName

arg_max was returning only a instance (the one with the most recent value) per computer in the form you used it in your question.


the query above will give you the most recent %Free for every logical disk.