Unable to configure alert for disk utilization

Question

Hi Team

i need to configure an alert if the disk utilization reaches 70% in azure portal. but i can't able to find the perfect matrix to set up. i am getting the signal options for CPU utilization, memory used etc but not getting option for disk used or disk space free.

kindly help me with the perfect steps.

Thanks and regards
Arun Kumar C V

Answer 1

Hello Arun,
As you will find on this article on Standard Metrics for Azure Virtual Machines

you will see that there are no Metric for Logical Disk free space on an Azure Virtual Machine resource.

To create an Azure Monitor Alert Rule that will generate an alert on Logical Disk % free disk space, you first need to collect this information in an Azure Log Analytics Workspace, then build a Kusto Query as a signal for your Alert rule to analyze the log data for that performance counter / metric.

If you enable Azure Monitor --> Virtual Machines insights on your Log Analytics Workspace (where you have those Azure VMs connected), you will be able to run the following KQL Query to visualize the overall information about Logical Disks Free space:

----------

*let AllData = (InsightsMetrics
| where Namespace == "LogicalDisk"
| where Name == "FreeSpacePercentage" or Name == "FreeSpaceMB"
| summarize arg_max(TimeGenerated, ) by Computer, Name,Tags
| extend Tags = todynamic(Tags)
| extend Size = toreal(Tags.["vm.azm.ms/diskSizeMB"])
| extend DriveLetter = tostring(Tags.["vm.azm.ms/mountId"]));
let FreeMBandSize = (
AllData
| where Name == "FreeSpaceMB"
| project Computer, DriveLetter, Size, ["Free MB"] =round(Val,2));
let PercentageFree = (
AllData
| where Name == "FreeSpacePercentage"
| project Computer, DriveLetter, ["Free %"] = round(Val,2));
FreeMBandSize
| join PercentageFree on Computer, DriveLetter
| project-away Computer1, DriveLetter1
| extend ["Size GB"] = round((Size / 1024),2)
| project-away Size
| project-reorder Computer, DriveLetter,['Size GB']
| extend ['Free %'] =
iif(['Free %'] between (30 .. 40), ['Free %'] = strcat("🟡 ", ['Free %']) // WARNING THRESHOLD
, iif( ['Free %'] < 30 , strcat("🔴 ", ['Free %']) // CRITICAL THRESHOLD
,strcat("🟢 ",['Free %']))) // OK

----------

To prepare the above query to be used in an Azure Monitor Logs based Alert Rule, you just need to add a condition at the end like:

| where ['Free %'] < 30

And then you could just click on Create Alert Rule from the Logs page where you executed this log search.

I hope it helps.
BR,
George