Azure Alert when vm is down or disk space is reaching for more then 80% of the Disk capacity with azure log analytics

Question

Hi,

I have setup the azure log analytics and vms are reporting to the workspace now want to create two alerts separately

1. User should get an Azure Alert when VM is down. Not sure how can we achieve because I tried using the heartbeat query but it is not giving the result:

Heartbeat
| where TimeGenerated > ago(10m)
| summarize LastHeartbeat = max(TimeGenerated) by Computer
| where isnotempty(Computer)
| where LastHeartbeat < ago(5m)
| where Computer == "Testvm"

To test this query I stopped the vm and tested this query to see if it shows the vm which was stopped but it did not worked.

2. Azure Alert when disk space is reaching more then 80% of the Disk capacity. I am not sure how to write the KQL for this one?

Regards
Rajaniesh

Answer 1

@Anonymous

For the Alerts on VM down, you can use Azure Monitor Service and get these alerts configured.
Please check this document for more information:
https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-metric

I just tried this and you have more signal names to choose in this way:

One more way of configuring alerts for VM is by configuring health alerts in Azure portal.
For the disk space alert, please check these documents which can help you create as per your requirement:

https://learn.microsoft.com/en-us/archive/blogs/ukhybridcloud/azure-log-analytics-disk-space-usage
https://learn.microsoft.com/en-us/archive/blogs/ukhybridcloud/azure-log-analytics-disk-space-usage-part-2

Below is an example for reference:

//This query below will show you the Machines with less than 10 Gb. With free diskspace.
// you can change the value, currently in 10 Gb.

InsightsMetrics
| where Name == "FreeSpacePercentage"
| summarize arg_max(TimeGenerated, *) by Tags
// arg_max over TimeGenerated returns the latest record
| project TimeGenerated, Computer, Val, Tags
| where Val < 10

Steps to create the Log Search Alert

1. Please go ahead into Log Analytics Workspace > Logs
2. Run the query above and adjust it to your need.
3. Click on run to test the result.
4. New alert rule

Hope this information helps.
Please 'Accept as answer' if the provided information is helpful, so that it can help others in the community looking for help on similar topics.