Azure Metrics Alert Threshold Value Question

LaVar Blalock 115 Reputation points
2023-05-31T12:41:10.31+00:00

Hello,

I am having a hard time trying to understand these threshold values:

I have a vm that has 89.3 percent free

I want an Azure Metric to send an alert when the free space is less than 15 percent. So i am testing out this Signal. How should i be setting this? Does this current value mean if the free space is greater than or equal to 99 % send an alert?

User's image

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,023 questions
Azure AI Metrics Advisor
Azure AI Metrics Advisor
An Azure artificial intelligence analytics service that proactively monitors metrics and diagnoses issues.
80 questions
0 comments No comments
{count} votes

Accepted answer
  1. Alistair Ross 7,106 Reputation points Microsoft Employee
    2023-06-01T09:25:29.0533333+00:00

    Hello @LaVar Blalock

    I can see that you are wanting to alert on Guest Metrics, and not logs. In this case the metric is '\LogicalDisk(_Total)% Free Space'.

    The first thing to understand is the aggregation types. I can see you have selected Total, which is the sum of all the values captured withing the aggregation window (the Lookback period). So for your instance, if you were looking at the last 5 minutes and the data is sampled at 1 minute intervals with a value of 50%, the total would be 250.

    I would be inclined to use either Average or Minimum depending on your time window and alerting requirements. The reason for this is that disk space doesn't usually change that fast (depending on your applications) and therefore average is usually good enough. This would allow for fluctuations in the disk space within the time period. However if you want to alert at any point it goes below the threshold, then minimum would achieve this, though you may find that this alerts more often, depending on your applications.

    https://learn.microsoft.com/en-gb/azure/azure-monitor/essentials/metrics-aggregation-explained?WT.mc_id=Portal-fx#aggregation-types

    Your Operator value wants to be "Less than or equal to". This is because you want to alert when the disk space is lower.

    Finally for testing, you can change the threshold to something high, like 95% to prove it alerts or or you could use fsutil to create a file with a size of your choice. Open the cmd prompt on your test device and run

    fsutil file createnew test 1048576
    
    

    This will create a 1MB file called test in the selected directory .

    I hope this helps

    Alistair

    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Richard Redgrave 890 Reputation points Microsoft Employee
    2023-06-01T08:52:15.5366667+00:00

    Hi,

    Yes you could test the current alert you have there by changing it to "Less than" and "15", but the most common way I see it is via a custom log rule. Something like this:

    Perf

    | where CounterName == "% Free Space"

    | where Computer == "VM"

    | where InstanceName == "C:"

    | where InstanceName != "_Total" and InstanceName !contains "HarddiskVolume"

    | summarize arg_max(TimeGenerated, *) by InstanceName

    | summarize AggregatedValue= avg(CounterValue) by Computer, bin(TimeGenerated, 1s)

    and then changing the alert logic to Metric measurement less than 15

    Hopefully this helps

    0 comments No comments