Forum Discussion
Azure Monitor Process Information
Hey All,
Been working with Azure monitor and I'm trying to add some improvements to some existing queries that I have. One bit of information I am looking for is capturing what account is running a process.
I have turned on all of the counters for process and processor, however when I do something as simple as
Perf
| where CounterName contains "process"
| where CounterName contains "processor"
I don't see any information RE what user account is running said processes. I also had a bit of a play around in windows performance monitor and could not obtain the information I was looking for via there.
If someone could help out here, that would be great, just trying to get the user information in azure monitor like you can in task manager so that I can enhance my queries to show what user was running a process at the time of an issue.
I don't see any information RE what user account is running said processes. I also had a bit of a play around in windows performance monitor and could not obtain the information I was looking for via there.
If someone could help out here, that would be great, just trying to get the user information in azure monitor like you can in task manager so that I can enhance my queries to show what user was running a process at the time of an issue.
3 Replies
- Noa Kuperberg
Microsoft
AFAIK Perf doesn't hold that data, but the SecurityEvent table (built by the security solution) will create it and collect user data as well:
Noa Kuperberg
Thanks for that 😄
So the security event table, would I be able to match up the process ID's to something in the security table in order to match the processes to users?
