You may have seen some of my previous blog posts about monitoring your servers using Azure Log Analytics. If not you can find them at https://pixelrobots.co.uk/2019/06/monitor-your-servers-cpu-usage-using-azure-log-analytics/. In this post, I am going to focus on using Azure Log Analytics to monitor your servers disk space. In fact, I am going to show you two methods I use. One will be a line chart so you can see trends and the other will be a table to give you a quick glance.
The prerequisites
You will need to have the Azure monitor agent installed on the VM’s you want to monitor. You can even monitor none Azure servers too. You can find more about installing the agent at https://docs.microsoft.com/en-us/azure/azure-monitor/platform/log-analytics-agent#install-and-configure-agent
The line graph method
Let’s start with the query first.
| // Chart disk if its under nnGB over the past nn days | |
| let setGBValue = 20; | |
| // enter a GB value to check | |
| let startDate = ago(2d); | |
| // enter how many days to look back on | |
| Perf | |
| | where InstanceName != "D:" and InstanceName contains ":" | |
| | where TimeGenerated > startDate | |
| | where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" | |
| | extend FreeSpaceGB = CounterValue/1024 | |
| | extend compDrive = strcat( tostring( Computer ), "/", tostring( InstanceName ) ) | |
| | summarize FreeSpace = min( FreeSpaceGB ) by compDrive | |
| | where FreeSpace < setGBValue | |
| | summarize max(FreeSpace) by compDrive | |
| | join | |
| ( | |
| Perf | |
| | where TimeGenerated > startDate | |
| | where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" | |
| | extend FreeSpaceGB = CounterValue/1024 | |
| | extend compDrive = strcat( tostring( Computer ), "/", tostring( InstanceName ) ) | |
| ) | |
| on compDrive | |
| | make-series FreeSpace = min( FreeSpaceGB ) on TimeGenerated from startDate to now() step 4h by compDrive | |
| | render timechart |
Let’s explain a bit
| // Chart disk if its under nnGB over the past nn days | |
| let setGBValue = 20; | |
| // enter a GB value to check | |
| let startDate = ago(2d); | |
| // enter how many days to look back on |
For let setGBValue enter the amount of free space in GB you would be worried about. So for example, if one of my drives has less then 20GB then I would want to know. So I set the Number to 20.
Now let startDate is how many days you would like the chart to go back to. I am using 2 days in this example, so my chart will be 2 days worth of data. You could change it to say 7h to just return data from the last 7 hours.
Now for the next part.
| Perf | |
| | where InstanceName != "D:" and InstanceName contains ":" | |
| | where TimeGenerated > startDate | |
| | where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" | |
| | extend FreeSpaceGB = CounterValue/1024 | |
| | extend compDrive = strcat( tostring( Computer ), "/", tostring( InstanceName ) ) | |
| | summarize FreeSpace = min( FreeSpaceGB ) by compDrive | |
| | where FreeSpace < setGBValue | |
| | summarize max(FreeSpace) by compDrive |
What we are doing here is excluding the D:\ as its normally used for the temporary drive in Azure. And then we are getting any drive or InstanceName as its called here that contains a :.
Next, we use the Free Megabytes Perf counter and then convert it to GB. The query then creates compDrive to add the computer name and drive letter together, separated by a /. It then uses the minimum value from the counter.
The query then filters out so only servers with free disk space less than the value we set before being used.
| | join | |
| ( | |
| Perf | |
| | where TimeGenerated > startDate | |
| | where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" | |
| | extend FreeSpaceGB = CounterValue/1024 | |
| | extend compDrive = strcat( tostring( Computer ), "/", tostring( InstanceName ) ) | |
| ) | |
| on compDrive | |
| | make-series FreeSpace = min( FreeSpaceGB ) on TimeGenerated from startDate to now() step 4h by compDrive | |
| | render timechart |
The query then basically performs the same query but joins it to the previous one. It then makes a series from now to the startdate. It then does step (a point on the chart) by 4 hours. You can change this but as I am using 2 days I find this is fine. The last line renders the query into a nice line chart.
Running the query
Now if you run it on your Log Analytics Workspace you should see something similar to the image below.
You will notice that even though the server does not currently have less free disk space the limit we set it is still showing in the graph. This is by design to help you look for issues or patterns over the time period set.
The table method
Again let’s start with the query first.
https://gist.github.com/ 348dc9dec8770a9687fb2f5089756340Let’s explain a bit
https://gist.github.com/ 348dc9dec8770a9687fb2f5089756340So, the top bit is basically the same as the first query, but I use 30 minutes instead of days.
https://gist.github.com/ 348dc9dec8770a9687fb2f5089756340We then have the main query where we use perf counters to check how much free megabytes are on each disk on each server. We then convert that to GB. The query then filters out all results to only display the ones that have less free disk space then the setGBValue we set.
https://gist.github.com/ 348dc9dec8770a9687fb2f5089756340Now the last line does something cool. Without it, we would just have the list of servers and if the server had multiple drives each drive would be another entry in the list. This line basically moves the drive from a row to a column based on the server. So basically each server would just have one entry but may have multiple columns depending on how many disks it has.
Running the query
When you run the query you should have something like the below image. For me to get results I had to set the setGBValue high.
Dashboards?
It’s is very easy to pin either to a dashboard, in fact, all you have to do is click the Pin button at the top right of the query window. This will then ask you what dashboard to save the Chart to. One thing to note is you will have needed to create a dashboard and share it first. Unfortunately, you are unable to create a dashboard from the pin drop down.
And that’s it. You are now monitoring free disk space on your Azure servers.
I hope you found this article helpful. If you have any questions or comments please reach out in the usual ways.
2 Comments
sandeep · July 5, 2020 at 9:25 am
Hi
Actually, i am planning to have receive low disk space alerts in azure, using log analytics query. So could you please let me know the query which gives the C: drive space in GB with simple attractive table format whenever there is low space on disk, i tried to check about “the table method” in you post but seems not accessible link. so please let me know
sandeep · July 5, 2020 at 11:53 am
Could you please provide the log analytics query/script which gives low disk space in GB and that can be used in azure to setup alerts whenever there are low disk space on any of server, the above “the table method” didn’t found working active link.