0

I was wondering if I could get some help with Log analytics. New to this so bear with me.

I'm trying to create a query that will provide informtaion on disk utilisation in Azure. I've gottwo commands (below), however I'm not able to merge them as I would like one query which gives me % free space, overall size of disk, name of vm and name of disk. Anything else I can get in terms of disk usage would be great, not overly concerned with IOPs at the moment.

The commands are:

This command below proivides info on free space: 

search ObjectName == "LogicalDisk" and CounterName == "% Free Space"

This command below provides information on free Mb remaining.

search ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"

I have tried this which helps, but again information is quite limited

search ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" and TimeGenerated > ago(1d) 
| summarize FreeSpace = min(CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":"

Thanks in advance :)

Norrin Rad
  • 881
  • 2
  • 18
  • 42
  • 1
    Do you try this `Perf | where (ObjectName == "LogicalDisk" and CounterName == "Free Megabytes") | summarize arg_max(TimeGenerated, *) by Computer | sort by TimeGenerated desc`. See this [link](https://learn.microsoft.com/en-us/azure/log-analytics/log-analytics-search-reference#next-steps). Hi, check comments. – Shui shengbao Feb 26 '18 at 05:47
  • @ShengbaoShui-MSFT thanks .. worked perfectly :) I tried using the same for iops, but didn’t work, I’ve got a question open on here, could you see where I’m going wrong please .. thanks again – Norrin Rad Mar 13 '18 at 08:15
  • `I tried using the same for iops` I will test in my lab. – Shui shengbao Mar 13 '18 at 08:24

2 Answers2

3

You can use the below script to query the Azure log database:

// % Disk free space
Perf | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName != "_Total"
| summarize CounterValue = min(CounterValue) by Computer, InstanceName, CounterName
| order by CounterValue asc nulls first

To limit output to disks with less than 20% free space just add an extra condition:

| where CounterValue < 20
Kate Orlova
  • 3,225
  • 5
  • 11
  • 35
Patrick Archibald
  • 46
  • 2
1

You could use the following command

Perf | where (ObjectName == "LogicalDisk" and CounterName == "Free Megabytes") | summarize arg_max(TimeGenerated, *) by Computer | sort by TimeGenerated desc

More information about this you could check this link.

Shui shengbao
  • 18,746
  • 3
  • 27
  • 45