I'm trying to find examples of queries that do similar things in logs portal of a VM. I want to query a VM to see if its been under % CPU usage and Memory usage for over 24 hours (ideally 30 days or so as well) This will determine if our VM's can potentially be scaled down.
I've looked at "az vm monitor metrics" but it doesn't appear to show the same information as the logs portal, or at least the docs are not very clear on how to get what I'm after if it's possible.
Is it possible to query under utilized VM's through Azure CLI
Yes, we can get the CPU and memory utilization of VM in one single chart by using KQL query
Below is the code
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| where Computer in ((Heartbeat | where OSType == "Linux" or OSType == "Windows" | distinct Computer))
| summarize MIN_CPU = min(CounterValue), AVG_CPU = avg(CounterValue), MAX_CPU = max(CounterValue) by Computer
| join
(
Perf
| where ObjectName == "Memory"
| where CounterName == "% Used Memory" or CounterName == "% Committed Bytes In Use"
| summarize MIN_MEM = min(CounterValue), AVG_MEM = avg(CounterValue), MAX_MEM = max(CounterValue) by Computer
) on Computer
| project Computer, MIN_CPU, AVG_CPU, MAX_CPU, MIN_MEM, AVG_MEM, MAX_MEM
And here is the CLI command for executing query
az monitor log-analytics query -w workspace-customId --analytics-query "AzureActivity | summarize count() by bin(timestamp, 1h)" -t P3DT12H
For complete information you can go through the related links
AZ monitor Log analytics query and KQL Log analytics query
Related
I am using the Azure Monitor Agent (AMA) to monitor a virtual machine.
I need to make an alert if the free disk is less than 10%.
For this purpose i'm using the guest metric "disk/free_percent", with mean as type of data aggregation.
On the graph, the values on the ordinate are the percentage of free disk? Because using df command on the virtual machine i have quite different values than the ones shown on the dashboard.
I have to make an alert if free disk is below 10%. What query i have to make using "disk/free_percent" to accomplish that task?
I've tryed to use operator "lesset than", unit as "number" and thrshold value as 10.
Disk Space will be computed in GB/MB units in general.
Instead of monitoring on a percentage basis, create an alert to check if the free disk space is less than 10gb.
As discussed here in Microsoft Q&A, I tried in my environment with a few modifications accordingly and I got the expected output for disk space.
Query:
let setgbvalue = 10;
Perf
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"
| where InstanceName !contains "C:"
| where InstanceName !contains "_Total"
| extend FreeSpaceGB = CounterValue/1024
| summarize FreeSpace = max(FreeSpaceGB) by InstanceName
| where FreeSpace < setgbvalue
Output:
If requirement is only with percentage, then you can use computing operations like countervalue/1024 multiplied by 100.
I have a network resource that only has bytes in and bytes out as metrics, I want to derive another metric with the addition of both bytesin+bytesout. Please suggest how I can add both in & out values and create an Azure Monitor Alert rule based on this new metric.
You cannot create a new metric by combining to existing ones. However, you can create an Alert Rule on a custom query. That means we can create a query like this
AzureMetrics
| where MetricName == "BitsInPerSecondTraffic" or MetricName == "BitsoutPerSecondTraffic"
| where ResourceType == "EXPRESSROUTECIRCUITS"
| summarize AggregatedValue = sum(Total) by bin(TimeGenerated, 15m)
Use that query to create an alert using the azure portal:
Im trying to figure out how to get a process from the Perf Table. The issue is that the process on the server has the same process name. I like to have cpu and memory usage for each unique process. this involves getting the process ID [PID] but i cant find it in azure log analytic workspace.
I'm pulling the custom performance counter to log analytic workstation:
\process(*)\*
Example:
get all svchost.exe to render in graph.
via unique PID
Perf
| where ObjectName == "Process"
| where InstanceName startswith "svchost"
| where CounterName == "% Processor Time"
| where Computer == "ServerNameHere"
| summarize CPUperMin = avg(CounterValue) by bin(TimeGenerated,1m)
| render timechart
//| distinct InstanceName
any ideas on how to find the PID? or KQL script to do this.
I wanted to get the performance report of my azure VMs using log analytics. I found a blog here
which shows what I wanted.
The problem is when I run the code in my log analytics, it gives all the details except FreeMemoryGB and TotalMemoryGB as shown in the screenshot in the blog. It just shows blank space.
Thanks
Thank you Arun and KrishnaG-MSFT. Posting your suggestions as an answer to help other community members.
"% Used Memory" is a counter available for Linux boxes only. For Windows "% Committed Bytes In Use" is the closest which can give the current memory in use for any windows VM.
Perf
| where TimeGenerated > ago(30m)
| where CounterName == "% Committed Bytes In Use"
| project TimeGenerated, CounterName, CounterValue, Computer
| summarize UsedMemory = avg(CounterValue) by CounterName, bin(TimeGenerated, 1m), Computer
| where UsedMemory > 20
| render timechart
If your Azure VM is Windows OS then query to find disk total free space is:
Perf
| where ( ObjectName == "LogicalDisk" )
| where ( CounterName == "% Free Space" )
| where ( InstanceName == "_Total" )
| summarize AggregatedValue= avg(CounterValue) by Computer, bin(TimeGenerated, 30s)
You can refer to Read Windows VM RAM Memory Log Analytics Query and Is there any API to query an Azure VM for free disk/memory space?
I've been working on Log Analytics Workspace query, there i'd like to know about the memory(RAM) being use by windows VM Specially, in linux vm we can get it from % Used Memory counter though not able yo get Windows VM. Query for Linux Used memory is shown below:
// Memory usage
Perf
| where TimeGenerated > ago(30m)
| where CounterName == "% Used Memory"
| project TimeGenerated, CounterName, CounterValue, Computer
| summarize UsedMemory = avg(CounterValue) by CounterName, bin(TimeGenerated, 1m), Computer
| where UsedMemory > 20
| render timechart
this would work pretty much the same for windows vms, but you need to configure which counters do you gather, before this query can work.
https://learn.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-performance-counters#configuring-performance-counters
#Sachin : You are right. "% Used Memory" is a counter available for Linux boxes only. For Windows "% Committed Bytes In Use" is the closest which can give you the current memory in use for any windows VM. The query can be the same what you have written but with the different counter name
Perf
| where TimeGenerated > ago(30m)
| where CounterName == "% Committed Bytes In Use"
| project TimeGenerated, CounterName, CounterValue, Computer
| summarize UsedMemory = avg(CounterValue) by CounterName, bin(TimeGenerated, 1m), Computer
| where UsedMemory > 20
| render timechart