How to use Azure Monitor to set up low disk space alerts for specific disk drives on a Windows VM

Question

For some time, I have been using the Log Analytics Windows Agent to collect data to trigger email alerts for Windows VMs when they are running low on disk space. I used the following custom alert rule to do this, which has worked very well for me:

Perf
| where CounterValue <= 25
| where CounterName == "% Free Space"
| where InstanceName == "C:" 

I was made aware that Log Analytics Windows Agents is now legacy and won't be supported as of August 31, 2024 and I should transition to the new Azure Monitor Windows Agent.

I tried to do this, setting up an Azure Monitor "Data Collection Rule" with "Performance Counters" as the only Resource. However, I noticed that the log results from the new Azure Monitor agents no longer provides "% Free Space" records for specific disk drives. Now, all the records only have an "InstanceName" of "_Total" instead of also having records with "InstanceName" of "C:", for instance. So I have to change the custom log alert rule to this, in order to get any results:

Perf
| where CounterValue <= 25
| where CounterName == "% Free Space"

While this works fine for VMs with only one disk drive, this is useless for a VM with multiple disk drives, including the temporary storage disks that many VM sizes include. The "_Total" adds up the free space of all the drives combined, making it impossible to determine when any specific drive is low on space.

For example, if the C drive is at 1% free space and the temporary D drive is 99.9% free, the log results will show a Total % Free Space of somewhere in between, like 46% free space. This is useless as I need the alerts to tell me when a specific drive is running low on space so I can prevent the drive from running out of space by increasing the disk size.

Is it possible accomplish what I am trying to do with the new Azure Monitor feature?

Answer 1

@Dave Ip

Thanks for giving me time to look into this issue.

When you setup your Data Collection Rule the default available Performance counter only includes _Total. However, you can add your own rule to capture the data that is available. To capture all available disks, you can type "\LogicalDisk(*)% Free Space" and select Add. Similarly, you can add individual disks using the same method.

Now when you run your query you will get the results for all disks that you query for the same customer alert rule you had previously used should function.

Hope this resolves your issue. Thanks for bringing this to our attention. I am working with the product team to better document this to avoid future confusion. Let me know if you have any other questions.

---

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.