Reading Time: 4 minutes
Share:
Twitter
LinkedIn
Facebook
Reddit
Whatsapp
Follow by Email

In this article, I am going to show you what I use to alert on when server disk space drops below a certain amount. You could use any normal server monitoring tool for this, but as my servers are in azure and have the Azure monitoring agent installed already, I thought to myself why not use Azure Log Analytics and Azure Monitor Alerts. Below you will see my query and instructions on how to set up the alert so you get emailed every hour if the alert has been triggered.

Lets start of with the query

// enter a GB value to check
let setgbvalue = 100;
// Query
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"
| where InstanceName !contains "D:"
| where InstanceName !contains "_Total"
| extend FreeSpaceGB = CounterValue/1024
| summarize FreeSpace = min(FreeSpaceGB) by Computer, InstanceName
| where FreeSpace < setgbvalue
view raw azure disk alert hosted with ❤ by GitHub

Looks simple right? Let me explain a bit.

The let setgbvalue is where you can change the value of free space the server can have before it alerts. I use 20gb. This will allow me enough time to fix any alerts before the server has issues.

Then I am doing a simple Perf query that looks over the last hour for the Object LocalDisk and Counter Free Megabytes. It then also looks for any instance that contains : . This basically looks for any drive that contains a :, so C:, D:, etc.

I then set a veriable called FreeSpaceGB to be the CounterValue (the Free Megabytes from the above lines) and dived it by 1024 to get the value in GB.

Next I use the Summarize command to FreeSpace = the minimum FreeSpaceGB by Computer and InstanceName. This will give us the Server name, which drive is affected and the FreeSpace.

The last line filters the results to only show servers with disk space less then the value set.

So we have the query but how do we get an email alert when a server goes under the set frees pace? For that we can use Azure Monitor and the alerts feature.

Setting the Alerts

To set the alert you will need to navigate to Azure Monitor in the Azure Portal.

In here click on Alerts.

Here you need to click on the blue + New alert rule button.

In this blade, you will need to select the Log Analytics workspace you have the servers associated to under the RESOURCE section.

You then need to add a CONDITION. This is where we add the query from before. Click on Add condition and then select Custom log search.

Paste in the query from before. You can change the setgbvalue to the value you need. Then set the Threshold to be 0.

Change the Evaluated based on values to 60 and then click Done.

Under ACTION GROUPS you can either Select existing or Create New. If you chose to create new you will have a blade like the shown. Just fill it in and click OK.

Now you have to enter some ALERT DETAILS. Here just give the alert rule a name and a description. You also have to set the Severity rating.

Once you have everything how you want it, click on Create alert rule.

Your alert has now been created and if you left the Enable rule upon creation enabled. Then as soon as an alert triggers you will receive an email. This will look something like this image.

There you have it. You are now being alerted when a server has less than 20gb of disk space.

I hope you found this article helpful. If you have any questions please reach out in the usual ways.

Share:
Twitter
LinkedIn
Facebook
Reddit
Whatsapp
Follow by Email
Categories: Azure

Pixel Robots.

I’m Richard Hooper aka Pixel Robots. I started this blog in 2016 for a couple reasons. The first reason was basically just a place for me to store my step by step guides, troubleshooting guides and just plain ideas about being a sysadmin. The second reason was to share what I have learned and found out with other people like me. Hopefully, you can find something useful on the site.

4 Comments

Crunch · January 24, 2019 at 10:22 am

Hi, good article.
Do you know how to remove from the report D:\ drive as a temp from VM’s in Azure?

    Pixel Robots. · March 20, 2019 at 2:43 pm

    Hello,

    To remove the d:\ from the report you can use the following code.

    // enter a GB value to check
    let setgbvalue = 100;
    // Query
    Perf
    | where TimeGenerated > ago(1h)
    | where ObjectName == “LogicalDisk” and CounterName == “Free Megabytes”
    | where InstanceName !contains “D:”
    | where InstanceName !contains “_Total”
    | extend FreeSpaceGB = CounterValue/1024
    | summarize FreeSpace = min(FreeSpaceGB) by Computer, InstanceName
    | where FreeSpace < setgbvalue I have updated the code above now also. Thanks.

Rizaan · August 22, 2019 at 10:32 am

hi

i used the code , however my report shows HarddiskVolume1 which my temp Drive , how do i remove this ?

appreciate your help thus far

excellent post

    Pixel Robots. · August 26, 2019 at 10:57 am

    Hello, You can add another | where to the query.

    | where InstanceName !contains “HarddiskVolume1”

    Just add it under the last | where InstanceName

Leave a Reply

Your email address will not be published. Required fields are marked *

*

I agree