#---------------------------------------------------------------------------------------------------------------
# Run --> Connect-AzAccount -DeviceCode
# Select Subscription when promped
# Define Variables VM Log Search Logical Space 

#---------------------------------------------------------------------------------------------------------------

$SubscriptionId    = (Get-AzContext).Subscription.Id										# No need to do anything since the subscription is selected at the Connect-AzAccount -DeviceCode if needed use Set-AzContext -SubscriptionId mysubscriptionid
$ResourceGroupName = "MyResourceGroup"												# Change the ResourceGroup
$Location          = "northcentralus"												# Change the Location of the VM's
$vmPathsFile = "C:\Scripts\VM\VMNames.txt"                                                                                      # Change the path of the files, put the VM each line
#$vmPaths = Get-Content $vmPathsFile
Write-Host "`nVM resource IDs found:" -ForegroundColor Cyan

foreach ($vmName in $vmNames) {
    Write-Host "Processing VM: $vmName"

# The scope for the alert: usually the VM’s resource ID
# or the resource group, or a subscription. Here we target a single VM:
$Scope = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Compute/virtualMachines/$VMName"


# The name for your new alert rule
$RuleName          = "Logical Space less 10 percent - $VMName"

# Put your Action group resource IDs, change here at the end of the line.
$ActionGroups      = @(
    "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/actiongroups/MyActionGroup"
)

# ------------------------------------------
# 4. Create Dimension Object (Optional)
# ------------------------------------------
$Dimension = New-AzScheduledQueryRuleDimensionObject `
    -Name      "Computer" `
    -Operator  "Include" `
    -Value     "*"

# ------------------------------------------
# 5. Define the Query and Condition
# ------------------------------------------

$Query = @"
InsightsMetrics
| where Origin == "vm.azm.ms"
| where Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"
| extend Disk = tostring(todynamic(Tags)["vm.azm.ms/mountId"])
| summarize LogicalDiskSpacePercentageFreeAverage = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk
| where LogicalDiskSpacePercentageFreeAverage <= 10
"@

# Here, we’ll assume you want to alert if the average free space 
# is <= 10%. So we set:a
#   -Operator        "LessThanOrEqual" 
#   -Threshold       "10" 
# The "AggregatedValue" can be a placeholder or 
# the column name used internally by Azure. 
# Usually "Val" or your summarized column.

$Condition = New-AzScheduledQueryRuleConditionObject `
    -Dimension                   $Dimension `
    -Query                       $Query `
    -TimeAggregation             "Average" `
    -MetricMeasureColumn         "LogicalDiskSpacePercentageFreeAverage" `
    -Operator                    "LessThanOrEqual" `
    -Threshold                   "10" `
    -FailingPeriodNumberOfEvaluationPeriod 1 `
    -FailingPeriodMinFailingPeriodsToAlert 1

foreach ($vmPath in $vmPaths) {
    $vmName  = $vmPath.Split('/')[-1]    # The VM name
    $ruleName = $RuleName

    Write-Host "Creating rule for:" $vmPath }

# ------------------------------------------
# 6. Create the Scheduled Query Rule
# ------------------------------------------

try {  
New-AzScheduledQueryRule `
    -Name                 $RuleName `
    -ResourceGroupName    $ResourceGroupName `
    -Location             $Location `
    -DisplayName          $RuleName `
    -Scope                $Scope `
    -Severity             2 `
    -WindowSize           ([TimeSpan]::FromMinutes(15)) `
    -EvaluationFrequency  ([TimeSpan]::FromMinutes(15)) `
    -CriterionAllOf       $Condition `
	-Description "$vmName LogicalDisk Space less than 10 Percent." `
    -ActionGroup          $ActionGroups
	
	Write-Host "LogicalDisk Space Alert Rule created successfully for VM: $vmName"
  } catch {
        Write-Host "LogicalDisk Space Failed to create Alert Rule for VM: $vmName. Error: $_"
  }
}


Write-Host "Scheduled query rule '$RuleName' created successfully."