Log Analytics Syntax post series: #1 Performance
This is a series of posts, which I will update and add to often (I hope), basically I’ve ended up with a OneNote of syntax that I know works in certain key areas of OMS.
Looking for % used space (this example and all the rest, require you to add the correct Perf counter in OMS -Settings)
Type=Perf (CounterName=”% Used Space”) | Measure min (CounterValue) by Computer
Looking for Free Space % on Widows machines, shown filtered by Computer
Type=Perf (ObjectName=LogicalDisk) (CounterName=”% Free Space”) | Measure min (CounterValue) by Computer
Taken a stage further by using a “as FreeSpace” column label and also sorting ASC (ASCending)
Type=Perf (ObjectName=LogicalDisk) (CounterName=”% Free Space”) | Measure min(CounterValue) As FreeSpace by Computer | Sort FreeSpace asc
This final version I create a DAILY Alert from to show me all the servers with less than 15% Free Space, it also shows the instance name which is the disk letter such as C:, D: etc…
Type=Perf (ObjectName=LogicalDisk) (CounterName=”% Free Space”) | Measure min(CounterValue) As FreeSpace by Computer, InstanceName | Sort FreeSpace asc | Where FreeSpace<15
Example Alert:
