question

RonakSheth avatar image
0 Votes"
RonakSheth asked tbgangav-MSFT edited

Setup Alert when free disk space falls below 5%

I am trying to setup a alert when the free space falls below 5% of its capacity.

I have written the below Kusto query as following.

 Perf
 | where CounterName == "% Free Space"
 | where Computer == "VM-01"
 | where InstanceName == "C:"
 | where InstanceName != "_Total" and InstanceName !contains "HarddiskVolume"
 | summarize arg_max(TimeGenerated, *) by InstanceName
 | project CounterValue

The query provides desired output while executing on the Log Analytics Workspace.

134005-image.png

When I use the same query on the Alert page, I get the preview output as 1 and the alert gets triggered even if the free space is a threshold value of 5%.

134006-image.png

Can anyone let me know where am I going wrong and point me in to correct direction?

Thanks in advance for helping me out.

Regards, Ronak.


azure-monitor
image.png (33.3 KiB)
image.png (49.7 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

tbgangav-MSFT avatar image
0 Votes"
tbgangav-MSFT answered tbgangav-MSFT edited

Hi @RonakSheth-4286,

As you have selected alert logic based on as "Number of results" so it's considering based on count of results table rows i.e., 1 result row in your case. Change the alert logic based on to "Metric measurement" and add aggregation type at the end of your kusto query then I believe it works as per your expectation.

Your kusto query can be something like shown below (or you may update it as required):

  Perf
  | where CounterName == "% Free Space"
  | where Computer == "VM-01"
  | where InstanceName == "C:"
  | where InstanceName != "_Total" and InstanceName !contains "HarddiskVolume"
  | summarize arg_max(TimeGenerated, *) by InstanceName
  | summarize AggregatedValue= avg(CounterValue) by Computer, bin(TimeGenerated, 1s) 

Illustration:
134111-image.png

For more information with regards to above mentioned two different alert logic based on measurement types, you may refer this Azure document.


image.png (52.9 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.