Azure Monitor / Log Analytics metric alert query

0
votes

I have an Azure Monitor log analytics workspace. I have the MMA agent installed on an Exchange server on-premises and it's uploading event and perf data to Azure. I can chart the monitor I'm interested in, based on this query:

Perf
| where CounterName == "Free Megabytes" and InstanceName == "D:" 
| where TimeGenerated > ago(7d)
| where Computer == "EXCH13.xxx.local"

I need to create an alert when available disk space goes below 20 GB but in trying to create a log based alert it's just alerting based on the number of times the query has run in a given time. And when I try to create a metrics based alert is says the query must include 'AggregatedValue' and 'bin(TimeGenerated, [roundTo])'. I just need it to look at the log data and let me know when it goes below 20 GB. Any ideas?

1
azureloggingmonitor
Regarding the issue, have you referred to docs.microsoft.com/en-us/azure/azure-monitor/platform/…? – Jim Xu
Hi Jim, yes I've had a look at that doc. I tried: Perf | where CounterName == "Free Megabytes" and InstanceName == "D:" | where TimeGenerated > ago(7d) | where Computer == "EXCH13.stepsemployment.local" | summarize AggregatedValue=sum(Count) by bin (timestamp,5min) And | summarize AggregatedValue=sum(Free Megabytes) by bin (timestamp,5min) I just don't know how to format it so that a metric alert works. Any ideas? – Paulschnack
Do you have any other concerns? If you have no other concerns, could you please accept my answer? It may help more people who have the issue. – Jim Xu

1 Answers

1
votes

According to my test, we can use the following query to view the log when the free disk space goes below xxx GB. For example

Perf
| where CounterName == "Free Megabytes" and InstanceName == "D:"
| where TimeGenerated > ago(7d)
| where Computer == "jimtest"
| where CounterValue <= 30720 (free disk space goes below 30 GB)

It will return logs with less than 30gb of free disk space. enter image description here

Regarding how to create alert condition, please refer to the following picture enter image description here It means that we will receive the alert when the number of logs with less than 20gb of free disk space.

For more details, please refer to the document. enter image description here

Update

According to my research, Azure monitor also provides the template of metrics Logical Disk Free Megabytes. For more details, please refer to the document. 1. Configure workspace to collect the metric enter image description here enter image description here

  1. configure condition enter image description here enter image description here