Azure Metrics Alert Threshold Value Question

Question

Hello,

I am having a hard time trying to understand these threshold values:

I have a vm that has 89.3 percent free

I want an Azure Metric to send an alert when the free space is less than 15 percent. So i am testing out this Signal. How should i be setting this? Does this current value mean if the free space is greater than or equal to 99 % send an alert?

Answer 1

Hello @LaVar Blalock

I can see that you are wanting to alert on Guest Metrics, and not logs. In this case the metric is '\LogicalDisk(_Total)% Free Space'.

The first thing to understand is the aggregation types. I can see you have selected Total, which is the sum of all the values captured withing the aggregation window (the Lookback period). So for your instance, if you were looking at the last 5 minutes and the data is sampled at 1 minute intervals with a value of 50%, the total would be 250.

I would be inclined to use either Average or Minimum depending on your time window and alerting requirements. The reason for this is that disk space doesn't usually change that fast (depending on your applications) and therefore average is usually good enough. This would allow for fluctuations in the disk space within the time period. However if you want to alert at any point it goes below the threshold, then minimum would achieve this, though you may find that this alerts more often, depending on your applications.

https://learn.microsoft.com/en-gb/azure/azure-monitor/essentials/metrics-aggregation-explained?WT.mc_id=Portal-fx#aggregation-types

Your Operator value wants to be "Less than or equal to". This is because you want to alert when the disk space is lower.

Finally for testing, you can change the threshold to something high, like 95% to prove it alerts or or you could use fsutil to create a file with a size of your choice. Open the cmd prompt on your test device and run

fsutil file createnew test 1048576

This will create a 1MB file called test in the selected directory .

I hope this helps

Alistair

Answer 2

Hi,

Yes you could test the current alert you have there by changing it to "Less than" and "15", but the most common way I see it is via a custom log rule. Something like this:

Perf

| where CounterName == "% Free Space"

| where Computer == "VM"

| where InstanceName == "C:"

| where InstanceName != "_Total" and InstanceName !contains "HarddiskVolume"

| summarize arg_max(TimeGenerated, *) by InstanceName

| summarize AggregatedValue= avg(CounterValue) by Computer, bin(TimeGenerated, 1s)

and then changing the alert logic to Metric measurement less than 15

Hopefully this helps