如何在Azure中利用InsightsMetrics实现特定驱动器低空间告警

需求背景 #

原本通过Perf表实现以下告警逻辑：监控特定驱动器（排除D:、_Total、HarddiskVolume1），当过去1小时内的最小可用空间低于200GB时触发告警。现需改用InsightsMetrics表实现相同逻辑。

原Perf查询代码：

let setgbvalue = 200;//Set the disk space you want to check for.  
Perf  
| where TimeGenerated > ago(1h) 
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" 
| where InstanceName != "D:"   
| where InstanceName  != "_Total"  
| where InstanceName != "HarddiskVolume1"  
| extend FreeSpaceGB = CounterValue/1024  
| summarize FreeSpace = min(FreeSpaceGB) by Computer, InstanceName  
| where FreeSpace < setgbvalue

用户尝试的InsightsMetrics代码：

let _minValue = 100; // Set the minValue according to your needs
InsightsMetrics
| where TimeGenerated >= ago(1h) // choose time to observe 
| where Origin == "vm.azm.ms"
| where Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"
| where Val <= _minValue
| extend t=parse_json(Tags)
| summarize avg(Val) by bin(TimeGenerated, 10m), Computer, tostring(t["vm.azm.ms/mountId"])
| sort by avg_Val asc

修正后的查询方案 #

要匹配原Perf的告警逻辑，需调整InsightsMetrics的字段选择和过滤规则，以下是修正后的查询：

let setgbvalue = 200; // 预设告警阈值（单位：GB）
InsightsMetrics
| where TimeGenerated > ago(1h)
| where Origin == "vm.azm.ms"
| where Namespace == "LogicalDisk" and Name == "FreeSpaceMB" // 选取可用空间绝对值（MB）
| extend Drive = tostring(parse_json(Tags)["vm.azm.ms/mountId"]) // 解析驱动器标识（对应原InstanceName）
| where Drive != "D:" 
| where Drive != "_Total" 
| where Drive != "HarddiskVolume1"
| extend FreeSpaceGB = Val / 1024 // 将MB转换为GB
| summarize FreeSpace = min(FreeSpaceGB) by Computer, Drive // 按机器和驱动器取1小时内最小可用空间
| where FreeSpace < setgbvalue // 筛选出低于阈值的记录

关键调整说明 #

• 字段替换：用FreeSpaceMB替代FreeSpacePercentage，直接匹配原Perf的可用空间绝对值逻辑，无需结合总空间计算百分比
• 驱动器匹配：通过解析Tags字段中的vm.azm.ms/mountId获取盘符，对应原Perf的InstanceName
• 聚合逻辑对齐：保持和原Perf一致，取1小时内的最小可用空间，确保捕捉到驱动器空间的最低状态
• 告警触发：此查询返回的所有记录即为需要触发告警的机器和驱动器，可直接用于配置Azure Monitor告警规则

内容的提问来源于stack exchange，提问作者Lebogang Mocoakae