Forum Discussion

Brass Contributor

Oct 08, 2020

Solved

Help understanding Processor counters

Hi all I'm trying to create a good query for Log Analytics to measure CPU average usage and peaks in order to determine whether the VM is under/over utilized. For a long time I've been using this...

azure monitor

Query Language

Stanislav_Zhelyazkov
Oct 12, 2020
HiDante Nahuel Ciai

The right query will be:

Perf | where CounterName =~ '% Processor Time' and ObjectName =~ 'Processor' and InstanceName =~ '_Total' | summarize AggregatedValue = avg(CounterValue) by _ResourceId

or if you have on-premises VMs

Perf | where CounterName =~ '% Processor Time' and ObjectName =~ 'Processor' and InstanceName =~ '_Total' | summarize AggregatedValue = avg(CounterValue) by Computer

Basically you only need _Total values for the counter. Besides average you can also use percentile() . I am not sure how max() will work for you as you can have a VM that once had for a second CPU at 100% and then all the time it was as low as 1%. Overall it depends on your logic and what kind of analysis you want to do.

Stanislav_Zhelyazkov

MVP

Oct 12, 2020

HiDante Nahuel Ciai

The right query will be:

Perf
| where CounterName =~ '% Processor Time' and ObjectName =~ 'Processor' and InstanceName =~ '_Total' 
| summarize AggregatedValue = avg(CounterValue) by _ResourceId

or if you have on-premises VMs

Perf
| where CounterName =~ '% Processor Time' and ObjectName =~ 'Processor' and InstanceName =~ '_Total' 
| summarize AggregatedValue = avg(CounterValue) by Computer

Basically you only need _Total values for the counter. Besides average you can also use percentile() . I am not sure how max() will work for you as you can have a VM that once had for a second CPU at 100% and then all the time it was as low as 1%. Overall it depends on your logic and what kind of analysis you want to do.

Dante Nahuel Ciai
Brass Contributor
Oct 12, 2020
Stanislav_Zhelyazkov Thank you for the answer. I came up with the same during the weekend. I removed the max() and instead went for percentile 95, and then check that value, which, if I understood correctly the counter, means that 95% of the sampled time, the counter value is below that value
So, if I go
Percentiles(CPU,5,50,95) and I get
0.5,20,100
it means that 5% of the time, the cpu is below 0.5%, 50% is below 20% and 95% is below 100%
is that correct?

Also, I could use bin to use max(), correct?
- Stanislav_Zhelyazkov
  MVP
  Oct 12, 2020
  Dante Nahuel Ciai Not sure if I can explain it better than the Kusto article or Wikipedia( https://en.wikipedia.org/wiki/Percentile#The_Nearest_Rank_method) but I can give you example where this is used a lot. It is used in measuring latency for web sites as there the average is not so important. Instead there you use percentile as you would want 95% of the customers to not experience high latency. Overall your explanation is also correct. You can use bin which will slice the data into time bins but really depends depends on the bins. Overall I do not think max is suitable for processor time. For example let's say that every hour you have the CPU going to 100 % for a second. If you slice your data to bins of 1 hour and calculate the maximum you will get that the CPU had maximum of 100% every hour but does that brings you any insights that you VM is not performing well?