We recently migrated to using Azure Monitor for alerting on infrastructure issues. However I recently found some servers weren't showing up when they were nearing capacity...
Our azure monitor alerts are based on kusto queries like:
Perf
| where TimeGenerated > ago(1h)
| where ObjectName in~ ('LogicalDisk', 'Logical Disk') and CounterName =~ '% Free Space'
| where not (InstanceName in~ ("_Total" , "total" )) and not (InstanceName startswith "/snap")
| summarize arg_max(TimeGenerated, CounterValue) by Computer, InstanceName, _ResourceId
| project Computer, InstanceName, _ResourceId, CounterValue, TimeGenerated
However, the servers in question had originally been setup by a team based in Spain / on investigation we'd found the OS language was set to Spanish, so the logs were in Spanish; i.e. we'd have to filter on ObjectName =~ 'Disco lógico' and CounterName =~ '% de espacio disponible' to see these logs.
Is there a "correct" way to deal with such scenarios?
We don't want to amend our queries to cater for all languages, it would be good to standardise the OSes on all servers to be in English by default, but that may impact apps hosted there so isn't a quick fix (though probably worth doing in the long run as that is our company's default language / all employees speak fluent English). I'm hoping there's some culture-insensitive value we an filter on (though I can't see any columns in the Perf table for this), or perhaps a setting which changes the language used by the Azure Monitor Agent when logging this information, without being impacted by the OS language.
A side question: could we use Kusto to fetch this language setting (i.e. would that data be in any of the tables produced by the Azure Monitor Agent or the Azure Guest VM Agent), so if we do standardise the language we can capture any VMs which deviate?
