Forum Discussion

Brass Contributor

Apr 30, 2020

Report on selected servers for a week on the memory usage

I would like a help with a Kusto query which I have almost completed but I am struggling in the last part. Kusto query Perf | where ObjectName == "Memory" and CounterName == "% Committed Bytes...

Azure Log Analytics

azure monitor

SamsonJohn

Copper Contributor

May 04, 2020

CliveWatson

Hello Clive thanks for the query , but what I observe is the difference in the actual memory in the Virtual Machine when compared with query output.

I used this query

Perf

| where TimeGenerated > startofday(ago(5d))

| where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use"

| extend Used_Percent_Memory = 100- CounterValue

| summarize Used_Percent_Memory = max(CounterValue)by bin(TimeGenerated,1d) , Computer, ObjectName

| where Used_Percent_Memory < 90 and Used_Percent_Memory > 70

So when a login to VM if I check , the latest it show memory less than 80 for live0 and live1 and for DB it is 87 % memory utilized

Please refer the above graph , not sure why this difference is coming

CliveWatson

Former Employee

May 04, 2020

SamsonJohn

In this section of the query we look at memory between 70 & 90 %, we take the max value seen on a given day (the BIN takes all the daily values and gives us one figure)

| summarize Used_Percent_Memory = max(CounterValue)by bin(TimeGenerated,1d) , Computer, ObjectName

| where Used_Percent_Memory < 90 and Used_Percent_Memory > 70

So when a login to VM if I check , the latest it show memory less than 80 for live0 and live1 and for DB it is 87 % memory utilized

So if memory is above 70% you will see it, based on the max value for that day, which isn't necessarily the current value.

You may need to look at the past hour broken into 1m BINS for this?

Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use"
| extend Used_Percent_Memory = 100- CounterValue
| summarize Used_Percent_Memory = max(CounterValue) by bin(TimeGenerated,1m) , Computer, ObjectName
//| where Used_Percent_Memory < 90 and Used_Percent_Memory > 70
| render timechart

CliveWatson
Former Employee
May 06, 2020
Swap this line

max(CounterValue)

to say

avg(CounterValue)
- SamsonJohn
  Copper Contributor
  May 06, 2020
  CliveWatson
  
  I have tried this replace max with avg as well but there is no differences here the result is same.
  still not returning the correct data for memory
  Was also going through this post https://sites.google.com/a/thetnaing.com/therunningone/how-to-calculate-systems-memory-utilization
  Was wondering do we need to apply the correct formula to evaluate the memory ,please suggest in regards to the same.
  - CliveWatson
    Former Employee
    May 07, 2020
    SamsonJohn
    
    Two questions,
    
    1. what is perf collection interval for the memory counter? My thoughts are if you are collecting to a different interval to Perfmon you may see variation based in aggregation.
    
    2. Are you using Perfmon (the counters and data is the same, apart from the collection interval); Task Manager can show different results.
    
    Go to Log Analytics and run query
    
    Perf
    
    | where TimeGenerated > ago(1h)
    
    | where Computer == "retailEUS7"
    
    | where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use"
    
    | summarize maxUsed_Percent_Memory = max(CounterValue),
    
    avgUsed_Percent_Memory = avg(CounterValue)
    
    by bin(TimeGenerated,1m) , Computer
    
    | project-away Computer
    
    | render timechart
    
    I think it unlikely Avg is the same as Max. See this example:
SamsonJohn
Copper Contributor
May 05, 2020
CliveWatson
Hi Clive , I have used the query to fetch details but it is giving me differences in the values for 10% when compared to actual memory utilization in Server and causing the invalid alert since I have set it for memory utilization >90 % based on this query.

Am check as this as well , any suggestion or helps in regards for this appreciated .
SamsonJohn
Copper Contributor
May 05, 2020
CliveWatson

Hi Clive,

I can still find the difference in percentage of the memory utilized in VM .
Please let me know if the query can be modified to get the average utilization of memory so as to get accurate utilization .