Forum Discussion
Automation to start/stop on conditions
Hi
I'm trying to perform an OMS automation that works on the following conditions:
|
Automatically brought online when certain nodes reach one of the following resource utilization levels:
Memory 85% for a 2hr duration (5min sampling periods) |
|
|
OR |
|
|
CPU 70% for a 15min duration (5 minute sampling periods)
Nodes brought up dynamically will be automatically shutdown at 11:00pm IF the following resource allocations are met: Memory is < 85% Utilization OR CPU < 70% utilization. |
I think for the cpu and/or memory query condition I should create 2 queries:
Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory")
| where CounterName == "% Committed Bytes In Use"
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 85
Perf
| where CounterName == "% Processor Time"
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 70
and use the OMS workspace Alert to start a runbook with a simple Start-VM.
However, i'm struggling with the following:
First, I don't know how to add a between condition with the time. I'm not sure about the syntax. I want to add a between 2 hours ago.
Second, I'm sure I should optimize and summarize both queries into one with one or condition, but, again, i'm struggling with syntax and how should I engage the problem.
And last of all
To met the stop condition AND the time of the day, that should be something like "where CPU < 70 or RAM < 85 AND time 11:00 pm"
Am I right?
Ok so for the time I understand i should use TimeGenerated ago(120m)
So the two queries should look like:
Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory")
| where CounterName == "% Committed Bytes In Use" and TimeGenerated =< ago(120m)
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 85
Perf
| where CounterName == "% Processor Time" and TimeGenerated =< ago(120m)
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 70Am i correct?
2 Replies
Ok so for the time I understand i should use TimeGenerated ago(120m)
So the two queries should look like:
Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory")
| where CounterName == "% Committed Bytes In Use" and TimeGenerated =< ago(120m)
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 85
Perf
| where CounterName == "% Processor Time" and TimeGenerated =< ago(120m)
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 70Am i correct?
Ok I think I made really good progress
So the start up OMS query should be like this:Two queries because both are not dependent on each other, one for CPU and one for RAM
Perf
| where CounterName == "% Committed Bytes In Use" and TimeGenerated > ago(2h)
| where ( Computer == "xxxx" or Computer == "xxxx" )
| summarize average_committed_bytes_percent = avg(CounterValue) by Computer
| where average_committed_bytes_percent > 85
That will trigger an alarm when more than 0 results are present
and that will trigger the automation account runbook with a simple start vms powershell script.Now the difficult part for me was the Stop VMs part because the request was to only activate it at 11:00 PM
So what i did was use a where at the end of the query getting hourofday(now()) == 23
and I think that did it.
Am I correct?Let me here some opinions.
Best regards