Forum Discussion

Rahul_Mahajan's avatar
Rahul_Mahajan
Brass Contributor
Jul 23, 2019
Solved

Monitor Azure Resource Only

Hi All,   I am using Azure LA for VM performance monitoring but it include on-prem servers also. When we run CPU or memory or disk utilization alerts it include all the servers in Azure and on-prem...
Azure Log Analytics
azure monitor
  • Stanislav_Zhelyazkov's avatar
    Stanislav_Zhelyazkov
    Jul 23, 2019

    HiRahul_Mahajan 

    Another way is to use _ResourceId column as a way of finding which VMs are in Azure.

    Currently all Azure VMs have _ResourceId so you can do:

    Perf
| where CounterName == "% Processor Time" and _ResourceId contains "virtualmachines"

    Additionally I would like to point out that all your queries are written incorrectly. You do not filter on CounterValue. First you need to summarize and than filter the threshold on the desired value. If you will use the queries for alerts than you do not filter in the query at all as the threshold is applied via the alert configuration. If you do not follow these rules you will get false positive on alerts.

CliveWatson's avatar
CliveWatson
Former Employee
Jul 23, 2019

Hello Rahul_Mahajan

 

You can add a join to the Heartbeat table, as that has a Azure / non-Azure value.  You'll need to do the same for the other two examples.

 

Heartbeat
| where ComputerEnvironment =="Azure"
| distinct Computer
| join (
    Perf
    | where CounterName == "% Processor Time"
        and CounterValue > 95
        and ObjectName == "Processor"
        and InstanceName == "_Total"
    | summarize arg_max(TimeGenerated, CounterValue) by Computer, CounterName
) on Computer

 

To test run it here Go to Log Analytics and Run Query

 

Resources