How to: Create an Alert for when there is 10% or less disk space on a hard disk or VM

Question

Good morning all:

We had disk space alerts working and randomly last month, they stopped working and started triggering false alerts. What is the best way in Azure Alerting to setup an alert for when a disk on a VM reach 10% or less disk space on a drive? Here are the queries we have tried that randomly send out false alerts:

**

• Query 1:

**
*Perf
| where TimeGenerated <= ago(10m)
| where ObjectName == "LogicalDisk"
| where CounterName == "% Free Space"
| where InstanceName !contains "_Total"
| where InstanceName !contains "HarddiskVolume"
| summarize arg_max(TimeGenerated, ) by InstanceName // arg_max over TimeGenerated returns the latest record
| where CounterValue <=10

**

• Query 2:

**
*// Virtual Machine free disk space
// Show the latest report of free disk space, per instance
InsightsMetrics
| where Name == "FreeSpacePercentage"
| summarize arg_max(TimeGenerated, ) by Tags
// arg_max over TimeGenerated returns the latest record
| project TimeGenerated, Computer, Val, Tags

**

• Query 3:

**
*// Virtual Machine free disk space
// Show the latest report of free disk space, per instance.
// To create an alert for this query, click '+ New alert rule'
Perf
| where ObjectName == "LogicalDisk" or // the object name used in Windows records
ObjectName == "Logical Disk" // the object name used in Linux records
| summarize arg_max(TimeGenerated, ) by InstanceName // arg_max over TimeGenerated returns the latest record
| project TimeGenerated, InstanceName, CounterValue, Computer, _ResourceId
| where InstanceName !contains "_Total"
| where InstanceName !contains "HarddiskVolume"
| where CounterValue <= 10

As mentioned, all of these were working up until about a month or so ago. Now they alert randomly when there is plenty of disk space available. When alert is triggered, it shows that threshold of space is at 0, but when you go to look at the log analytics for the query it shows that there is plenty of space left. Any assistance would be greatly appreciated.

Thank you,

Seth Berg

Answer 1

@Seth Berg

Based on your issue description, you would like to monitor the free disk space of your VM's and receive an alerts when is less than 10%.

In this case you need to have:
One Log Analytics Workspace to collect performance counters from your VM.
Connect the server to the Log Analytics Workspace.
Configured the Log Analytics workspace to collect performance counters from your VM.

Please find below steps in detail:

Follow this document to create a log analytics workspace.

Then you need to go to your log analytics workspace and configure it to collect performance counters as per this document.

Note: If you only need to monitor the % used in the disk I would like to suggested you only enable "% Used space".

Once you have configured your Log Analytics workspace to collect performance counters, you only need to connect your VM to your Log Analytics Workspace.
Under Virtual machines, select the workspace you would like to monitor and click on it.

You are going to see this screen in which you only need to click on "Connect" this step is going to install the OMS agent in your VM to collect the data from the VM into the Log Analytics Workspace. You can find more information about this agent in this documentation.

Now that you already have the VM connected to your Log Analytics Workspace and collecting performance counters. You only need to use below query to configure the alert.

Perf
| where ObjectName == "Logical Disk" and CounterName == "% Used Space"
| extend Used_Space_Percent = CounterValue
| summarize by Computer, InstanceName, Used_Space_Percent
//This section is meant to return logs that reflect when the % Used Space is above a user-defined threshold
| where Used_Space_Percent > 90 //where is set the condition you would like to mointor in this case when the value is above 90 it means its less than 10% free.

Go to the option "Logs" paste the query and run it, once you run the query you are going to see enable the button "+ New alert rule", to create the alert.

Create the alert following this documentation.

In the tab "Actions" there you can follow the document to create an action group to send emails, you can follow this documentation to create and configure the action group.

Hope this helps.
If you need further help on this, tag me in a comment.
If the suggested response helped you resolve your issue, please 'Accept as answer', so that it can help others in the community looking for help on similar topics.