Hi VIshnu,
Sorry if I misunderstood your question! The performance counter \LogicalDisk(_Total)\% Free Space
provides an aggregate value across all logical disks (OS disk + data disks), not individual drives.
If my disk free space is less than 15% [if my keep \LogicalDisk(_Total)% Free Space then does this check for all the attached disk for the VM or only OS disk ]
This checks all the Total - All disks combined.
One of the most common monitoring requirements for a virtual machine is to create an alert if it stops running. The best method is to create a metric alert rule in Azure Monitor by using the VM availability metric. For a walk-through on this metric, see Create availability alert rule for Azure virtual machine.
Metric alert rules
A metric called Heartbeat is included in each Log Analytics workspace. Each virtual machine connected to that workspace sends a heartbeat metric value each minute. Because the computer is a dimension on the metric, you can fire an alert when any computer fails to send a heartbeat. Set the Aggregation type to Count and the Threshold value to match the Evaluation granularity.
Log search alert rules
Log search alerts use the Heartbeat table, which should have a heartbeat record every minute from each machine.
Use a rule with the following query:
Heartbeat | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff('minute',now(),TimeGenerated) | summarize MinutesSinceLastHeartbeat = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId
Hope it helps!