help to set up azure alert for disk space alert when 10gb or less

Question

I've had a look around this forum but I can't find anything specific to virtual machines on Azure.

I thought it would have been an option as a Signal name (see screenshot below)

please can you point me in the right direction?

thanks

Stephen

Answer 1

@Stephen Lawrence Apologies for the delay in response and all the inconvenience caused because of the issue.

I did some research and found below which might be helpful in your use case:

// enter a GB value to check  
let setgbvalue = 100;  
// Query  
Perf  
| where TimeGenerated > ago(1h)  
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"  
| where InstanceName !contains "D:"  
| where InstanceName  !contains "_Total"   
| extend FreeSpaceGB = CounterValue/1024  
| summarize FreeSpace = min(FreeSpaceGB) by Computer, InstanceName  
| where FreeSpace < setgbvalue  

The let setgbvalue is where you can change the value of free space the server can have before it alerts. In example we are using 20gb. This will allow you enough time to fix any alerts before the server has issues.

Then doing a simple Perf query that looks over the last hour for the Object LocalDisk and Counter Free Megabytes. It then also looks for any instance that contains : . This basically looks for any drive that contains a :, so C:, D:, etc.

We then set a variable called FreeSpaceGB to be the CounterValue (the Free Megabytes from the above lines) and dived it by 1024 to get the value in GB.

Next we use the Summarize command to FreeSpace = the minimum FreeSpaceGB by Computer and InstanceName. This will give us the Server name, which drive is affected and the FreeSpace.

The last line filters the results to only show servers with disk space less then the value set.

So we have the query but how do we get an email alert when a server goes under the set frees pace? For that we can use Azure Monitor and the alerts feature.

Setting the Alerts

To set the alert you will need to navigate to Azure Monitor in the Azure Portal.

In here click on Alerts.

Here you need to click on the blue + New alert rule button.

In this blade, you will need to select the Log Analytics workspace you have the servers associated to under the RESOURCE section.

You then need to add a CONDITION. This is where we add the query from before. Click on Add condition and then select Custom log search.

Paste in the query from before. You can change the setgbvalue to the value you need. Then set the Threshold to be 0.

Change the Evaluated based on values to 60 and then click Done.

Under ACTION GROUPS you can either Select existing or Create New. If you chose to create new you will have a blade like the shown. Just fill it in and click OK.

Now you have to enter some ALERT DETAILS. Here just give the alert rule a name and a description. You also have to set the Severity rating.

Once you have everything how you want it, click on Create alert rule.

Your alert has now been created and if you left the Enable rule upon creation enabled. Then as soon as an alert triggers you will receive an email. This will look something like this image.

There you have it. You are now being alerted when a server has less than 20gb of disk space. You can configure same alert for 10 gb as well.

Hope it helps.

Please 'Accept as answer' if it helped, so that it can help others in the community looking for help on similar topics

Answer 2

looks like a joke. we are just asking about a simple alert..

Answer 3

Use this instead, or you will get false positives due to the values returned from "HarddiskVolume" from InstanceName

// enter a GB value to check
let setgbvalue = 10;
// Query
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"
| where InstanceName !contains "D:"
| where InstanceName !contains "_Total"  
| where InstanceName !contains "HarddiskVolume"
| extend FreeSpaceGB = CounterValue/1024
| summarize FreeSpace = min(FreeSpaceGB) by Computer, InstanceName
| where FreeSpace < setgbvalue

Answer 4

| where InstanceName !contains "D:" : will exclude all D:\ drives. How do I exclude only the D:\ drive from a specific computer?

This query below does not work, as it excludes the whole computer and all F:\ drives even though it says AND!!:
| where Computer != "<servername>" and InstanceName != "<drive letter>"

How do I fix this to only exclude the one drive from this specific server???

Thank you

Answer 5

Can you help to setup the disk alert on azure Linux VM.