Disk query in Log Analytics on Azure

0
votes

I was wondering if I could get some help with Log analytics. New to this so bear with me.

I'm trying to create a query that will provide informtaion on disk utilisation in Azure. I've gottwo commands (below), however I'm not able to merge them as I would like one query which gives me % free space, overall size of disk, name of vm and name of disk. Anything else I can get in terms of disk usage would be great, not overly concerned with IOPs at the moment.

The commands are:

This command below proivides info on free space: 

search ObjectName == "LogicalDisk" and CounterName == "% Free Space"

This command below provides information on free Mb remaining.

search ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"

I have tried this which helps, but again information is quite limited

search ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" and TimeGenerated > ago(1d) 
| summarize FreeSpace = min(CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":"

Thanks in advance :)

2
azureanalyticsazure-log-analytics
Do you try this Perf | where (ObjectName == "LogicalDisk" and CounterName == "Free Megabytes") | summarize arg_max(TimeGenerated, *) by Computer | sort by TimeGenerated desc. See this link. Hi, check comments. – Shui shengbao
@ShengbaoShui-MSFT thanks .. worked perfectly :) I tried using the same for iops, but didn’t work, I’ve got a question open on here, could you see where I’m going wrong please .. thanks again – Norrin Rad
I tried using the same for iops I will test in my lab. – Shui shengbao

2 Answers

3
votes

You can use the below script to query the Azure log database:

// % Disk free space
Perf | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName != "_Total"
| summarize CounterValue = min(CounterValue) by Computer, InstanceName, CounterName
| order by CounterValue asc nulls first

To limit output to disks with less than 20% free space just add an extra condition:

| where CounterValue < 20
1
votes

You could use the following command

Perf | where (ObjectName == "LogicalDisk" and CounterName == "Free Megabytes") | summarize arg_max(TimeGenerated, *) by Computer | sort by TimeGenerated desc

More information about this you could check this link.