Azure Arc Server Alerts - Data Difference in Insights Performance vs Logs

Question

Hello everyone,

Problem:

I am trying to setup an alert that fires when an Azure Arc server is below 10% total free space percentage based off all drives. The problem is, the data showed in the Monitoring>Insights>Performance section of the server doesn't match up with the Data pulled in Monitoring>Logs from a KQL query.

Insights:

Query:

InsightsMetrics
| where Origin == "vm.azm.ms"
| where Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"
| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId

Questions:
Why doesn't this data match up despite having the same time range?
What is the best way to set up alerting for azure arc severs. I have been doing it through Alerts

Answer 1

@Terrell Woodard , Thank you for the question.

I see that you are trying to query Log Analytics workspace to get the result similar to "Logical Disk Performce" section in VM Insights --> Performance.

Note that the values obtained in table (1) posted above, are also obtained from the LA workspace where the insights are storing the telemetry data. However, there are some issues with the queries being used:

1. Origin does not equal "VM", hence you should be filtering based on the Computer column.
2. Summarize by _ResourceId creates aggregates based on VM as the _ResourceId field points to the VM source. However, the table shows values aggregated by disks for the selected VM.
3. You are querying "FreeSpacePercentage", however the table shows used %, hence you will have to subtract from 100.

Here is a sample query which you can use to get a similar result. Note that this query is based on information available about performance record - VM Insights Performance Records

InsightsMetrics
| where Computer == 'MM-Windows-UM'
| where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'
| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Tags //Tags store information about the logical disk, see "VM Insights Performance Records link above.
| project Disk=split(Tags,'"')[-2], UsedPct= 100-AggregatedValue

Hope this helps.

If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.