Setting Up a Disk Monitoring Alert Rule for an Azure Arc enabled VM (Azure)

This article has not been completed yet. However, it may already contain  helpful Information and therefore it has been published at this stage.

# Logical disk space % below threshold
let _minValue = 20;
Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName != "_Total" and InstanceName != "HarddiskVolume1" and InstanceName != "HarddiskVolume2"
| where TimeGenerated >= ago(5m)
| where CounterValue <= _minValue
| summarize  arg_max(TimeGenerated, *)by InstanceName
| project Computer, InstanceName, CounterName, CounterValue 

ARM - Template:

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vm_name": {
            "type": "String"
        },
        "location": {
            "type": "string",
            "defaultValue": "[resourceGroup().location]",
            "metadata": {
            "description": "Location of the virtual machine"
            }
        },
        "alertSeverity": {
            "type": "int",
            "defaultValue": 3,
            "allowedValues": [
                0,
                1,
                2,
                3,
                4
            ]
        }
    },
    "variables": {
		"actiongroup_mail_externalid_var": "[concat('/subscriptions/',subscription().subscriptionId,'/resourceGroups/',resourceGroup().name,'/providers/microsoft.insights/actiongroups/mail')]",
        "vm_externalid_var":"[concat('/subscriptions/',subscription().subscriptionId,'/resourceGroups/',resourceGroup().name,'/providers/Microsoft.HybridCompute/machines/',parameters('vm_name'))]",
        "alertrulename":"[concat('Disk (',parameters('vm_name'),')')]"

	},
    "resources": [
        {
            "type": "microsoft.insights/scheduledqueryrules",
            "apiVersion": "2021-08-01",
            "name": "[variables('alertrulename')]",
            "location": "[parameters('location')]",
            "properties": {
                "displayName": "[variables('alertrulename')]",
                "severity": "[parameters('alertSeverity')]",
                "enabled": true,
                "evaluationFrequency": "PT5M",
                "scopes": [
                    "[variables('vm_externalid_var')]"
                ],
                "targetResourceTypes": [
                    "Microsoft.HybridCompute/machines"
                ],
                "windowSize": "PT5M",
                "overrideQueryTimeRange": "P2D",
                "criteria": {
                    "allOf": [
                        {
                            "query": "let _minValue = 20;\nPerf\n| where ObjectName == \"LogicalDisk\" and CounterName == \"% Free Space\" and InstanceName != \"_Total\" and InstanceName != \"HarddiskVolume1\" and InstanceName != \"HarddiskVolume2\"\n| where TimeGenerated >= ago(5m)\n| where CounterValue <= _minValue\n| summarize  arg_max(TimeGenerated, *)by InstanceName\n| project Computer, InstanceName, CounterName, CounterValue \n",
                            "timeAggregation": "Average",
                            "metricMeasureColumn": "CounterValue",
                            "dimensions": [],
                            "operator": "GreaterThanOrEqual",
                            "threshold": 1,
                            "failingPeriods": {
                                "numberOfEvaluationPeriods": 1,
                                "minFailingPeriodsToAlert": 1
                            }
                        }
                    ]
                },
                "autoMitigate": true,
                "actions": {
                    "actionGroups": [
                        "[variables('actiongroup_mail_externalid_var')]"
                    ]
                }
            }
        }
    ]
}