In this article, I am going to show you what I use to alert on when server disk space drops below a certain amount. You could use any normal server monitoring tool for this, but as my servers are in azure and have the Azure monitoring agent installed already, I thought to myself why not use Azure Log Analytics and Azure Monitor Alerts. Below you will see my query and instructions on how to set up the alert so you get emailed every hour if the alert has been triggered.
Lets start of with the query
|// enter a GB value to check|
|let setgbvalue = 100;|
|| where TimeGenerated > ago(1h)|
|| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"|
|| where InstanceName !contains "D:"|
|| where InstanceName !contains "_Total"|
|| extend FreeSpaceGB = CounterValue/1024|
|| summarize FreeSpace = min(FreeSpaceGB) by Computer, InstanceName|
|| where FreeSpace < setgbvalue|
Looks simple right? Let me explain a bit.
The let setgbvalue is where you can change the value of free space the server can have before it alerts. I use 20gb. This will allow me enough time to fix any alerts before the server has issues.
Then I am doing a simple Perf query that looks over the last hour for the Object LocalDisk and Counter Free Megabytes. It then also looks for any instance that contains : . This basically looks for any drive that contains a :, so C:, D:, etc.
I then set a veriable called FreeSpaceGB to be the CounterValue (the Free Megabytes from the above lines) and dived it by 1024 to get the value in GB.
Next I use the Summarize command to FreeSpace = the minimum FreeSpaceGB by Computer and InstanceName. This will give us the Server name, which drive is affected and the FreeSpace.
The last line filters the results to only show servers with disk space less then the value set.
So we have the query but how do we get an email alert when a server goes under the set frees pace? For that we can use Azure Monitor and the alerts feature.
Setting the Alerts
To set the alert you will need to navigate to Azure Monitor in the Azure Portal.
In here click on Alerts.
Here you need to click on the blue + New alert rule button.
In this blade, you will need to select the Log Analytics workspace you have the servers associated to under the RESOURCE section.
You then need to add a CONDITION. This is where we add the query from before. Click on Add condition and then select Custom log search.
Paste in the query from before. You can change the setgbvalue to the value you need. Then set the Threshold to be 0.
Change the Evaluated based on values to 60 and then click Done.
Under ACTION GROUPS you can either Select existing or Create New. If you chose to create new you will have a blade like the shown. Just fill it in and click OK.
Now you have to enter some ALERT DETAILS. Here just give the alert rule a name and a description. You also have to set the Severity rating.
Once you have everything how you want it, click on Create alert rule.
Your alert has now been created and if you left the Enable rule upon creation enabled. Then as soon as an alert triggers you will receive an email. This will look something like this image.
There you have it. You are now being alerted when a server has less than 20gb of disk space.
I hope you found this article helpful. If you have any questions please reach out in the usual ways.