Improvement Recommendation: AMSP-Win-VMI-DiskSpaceUnderPercentCritical

Currently, threshold is hard coded into the query, and is looking at a point in time. A better approach is to look at it over a time frame, and allow threshold to be set in alert logic.

Recommended Query:

InsightsMetrics
| where Namespace == 'LogicalDisk'
and Name == 'FreeSpacePercentage'
and Origin == "vm.azm.ms"
| extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"])
| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), _ResourceId, Disk

Measure = AggregatedValue
Aggregation Type = Average

Alert Logic
Operator: Less than
Threshold 5

In this configuration, Disk is exposed as an additional dimension to split on, so customers can exclude snap, etc