Setup Alert when free disk space falls below 5%

Question

I am trying to setup a alert when the free space falls below 5% of its capacity.

I have written the below Kusto query as following.

Perf  
| where CounterName == "% Free Space"  
| where Computer == "VM-01"  
| where InstanceName == "C:"  
| where InstanceName != "_Total" and InstanceName !contains "HarddiskVolume"  
| summarize arg_max(TimeGenerated, *) by InstanceName  
| project CounterValue  
  

The query provides desired output while executing on the Log Analytics Workspace.

When I use the same query on the Alert page, I get the preview output as 1 and the alert gets triggered even if the free space is a threshold value of 5%.

Can anyone let me know where am I going wrong and point me in to correct direction?

Thanks in advance for helping me out.

Regards, Ronak.

Answer 1

Hi @RonakSheth-4286,

As you have selected alert logic based on as "Number of results" so it's considering based on count of results table rows i.e., 1 result row in your case. Change the alert logic based on to "Metric measurement" and add aggregation type at the end of your kusto query then I believe it works as per your expectation.

Your kusto query can be something like shown below (or you may update it as required):

 Perf  
 | where CounterName == "% Free Space"  
 | where Computer == "VM-01"  
 | where InstanceName == "C:"  
 | where InstanceName != "_Total" and InstanceName !contains "HarddiskVolume"  
 | summarize arg_max(TimeGenerated, *) by InstanceName  
 | summarize AggregatedValue= avg(CounterValue) by Computer, bin(TimeGenerated, 1s)   

Illustration:

For more information with regards to above mentioned two different alert logic based on measurement types, you may refer this Azure document.