Azure Monitor / Log Analytics metric alert query

Question

I have an Azure Monitor log analytics workspace. I have the MMA agent installed on an Exchange server on-premises and it's uploading event and perf data to Azure. I can chart the monitor I'm interested in, based on this query:

Perf
| where CounterName == "Free Megabytes" and InstanceName == "D:" 
| where TimeGenerated > ago(7d)
| where Computer == "EXCH13.xxx.local" 

I need to create an alert when available disk space goes below 20 GB but in trying to create a log based alert it's just alerting based on the number of times the query has run in a given time. And when I try to create a metrics based alert is says the query must include 'AggregatedValue' and 'bin(TimeGenerated, [roundTo])'. I just need it to look at the log data and let me know when it goes below 20 GB. Any ideas?

Answer 1

According to my test, we can use the following query to view the log when the free disk space goes below xxx GB. For example

Perf
| where CounterName == "Free Megabytes" and InstanceName == "D:"
| where TimeGenerated > ago(7d)
| where Computer == "jimtest"
| where CounterValue <= 30720 (free disk space goes below 30 GB)

It will return logs with less than 30gb of free disk space.

Regarding how to create alert condition, please refer to the following picture It means that we will receive the alert when the number of logs with less than 20gb of free disk space.

For more details, please refer to the document .

---

Update

According to my research, Azure monitor also provides the template of metrics Logical Disk Free Megabytes . For more details, please refer to the document . 1. Configure workspace to collect the metric

2. configure condition