Home

Perf counter

%3CLINGO-SUB%20id%3D%22lingo-sub-240205%22%20slang%3D%22en-US%22%3EPerf%20counter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-240205%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20can%20I%20get%20Perf%20data%20for%20the%20past%2024hrs%20for%20CPU%2C%20Memory%2C%20using%20log%20analytics%20so%20that%20I%20can%20export%20the%20data%20and%20create%20CPU%20chart%20outside%20Azure%20for%20the%20past%2024hrs.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-240205%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-241126%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Perf%20counter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-241126%22%20slang%3D%22en-US%22%3E%3CP%3Enice%2C%20I%20knew%20there%20had%20to%20be%20a%20way%20to%20summarize%20multiple%20values%20in%20the%20same%20perf%20query%2C%20thanks!%20and%20evaluate%20pivot%20has%20been%20on%20my%20short%20list%20to%20understand%20better.%20Thanks%20for%20that%2C%20two%20birds%2C%20one%20stone.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-241113%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Perf%20counter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-241113%22%20slang%3D%22en-US%22%3E%3CP%3EA%20more%20concise%20way%20to%20express%20the%20same%20thing%20without%20needing%20to%20join.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CPRE%3E%3CSPAN%3EPerf%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20(ObjectName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Memory%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Committed%20Bytes%20In%20Use%22%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3Eor%3C%2FSPAN%3E%3CSPAN%3E%20(ObjectName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Processor%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Processor%20Time%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20InstanceName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22_Total%22%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20TimeGenerated%20%26lt%3B%20now(%3C%2FSPAN%3E%3CSPAN%3E24%3C%2FSPAN%3E%3CSPAN%3Eh)%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20avg(CounterValue)%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20bin(TimeGenerated%2C%20%3C%2FSPAN%3E%3CSPAN%3E1%3C%2FSPAN%3E%3CSPAN%3Eh)%2C%20Computer%2C%20ObjectName%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eevaluate%3C%2FSPAN%3E%3CSPAN%3E%20pivot(ObjectName%2C%20avg(avg_CounterValue))%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eproject%3C%2FSPAN%3E%3CSPAN%3E%20TimeGenerated%2C%20Computer%2C%20Processor%2C%20Memory%3C%2FSPAN%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-240704%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Perf%20counter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-240704%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20There%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20only%20get%20below%20things%20in%20Perf%20query%20as%20per%20schema%20of%20this%20query%20synatx.%20I%20am%20not%20sure%20if%20you%20can%20get%20any%20custom%20thing%20apart%20from%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3ETenantId%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3EComputer%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3EObjectName%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3ECounterName%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3EInstanceName%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3ECounterValue%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3ETimeGenerated%20%5BCentral%20Time%20(US%20and%20Canada)%5D%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3ESourceSystem%3C%2FSTRONG%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-240542%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Perf%20counter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-240542%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20looks%20like%20it%20can%E2%80%99t%20find%20the%20field%20%E2%80%9CContainerName%E2%80%9D%26nbsp%3B%20Make%20sure%20the%20case%20is%20correct%20and%20ContainerName%20is%20part%20of%20the%20Perf%20Schema.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-240532%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Perf%20counter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-240532%22%20slang%3D%22en-US%22%3E%3CP%3EThx%20for%20reply.%20I%20am%20looking%20for%20help%20with%20the%20query%20itself.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20startTimestamp%20%3D%20ago(1d)%3B%3C%2FP%3E%3CP%3EPerf%3C%2FP%3E%3CP%3E%7C%20where%20ContainerName%20%3D%3D%20%22platformservices%22%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E'where'%20operator%3A%20Failed%20to%20resolve%20column%20or%20scalar%20expression%20named%20'ContainerName'%20Support%20id%3A%206676cddc-3db3-46ec-bab9-76aeddf5b402%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-240501%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Perf%20counter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-240501%22%20slang%3D%22en-US%22%3E%3CP%3Esorry%20I%20forgot%2C%20once%20you're%20happy%20with%20the%20query%20and%20the%20data%20you%20can%20export%20the%20data%20to%20CSV%20as%20shown%20in%20the%20screen%20grab.%20or%20you%20can%20connect%20PowerBI.%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F44514i7D0817361F84B67E%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%222018-08-30_14-33-24.png%22%20title%3D%222018-08-30_14-33-24.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-240491%22%20slang%3D%22en-US%22%3ERE%3A%20Perf%20counter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-240491%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Sunil%2C%20you%20didn't%20give%20a%20whole%20lot%20to%20go%20on%2C%20so%20I%20made%20some%20assumptions.%20This%20will%20get%20the%20%25%20of%20memory%20in%20use%20over%20the%20last%2024%20hours%20bin%20by%201%20hour%20and%20join%20it%20with%20CPU%20over%20the%20last%2024%20hours%20also%20bin%20by%2024%20hours.%3C%2FP%3E%3CP%3E%2F%2Fget%20%25%20of%20memory%20last%2024%20hours%20bin%20time%20generated%201%20hour%3C%2FP%3E%3CP%3Elet%20AvgMem%20%3D%20Perf%3C%2FP%3E%3CP%3E%7C%20where%20ObjectName%20%3D%3D%20%22Memory%22%3C%2FP%3E%3CP%3Eand%20CounterName%20%3D%3D%20%22%25%20Committed%20Bytes%20In%20Use%22%3C%2FP%3E%3CP%3Eand%20TimeGenerated%20%26lt%3B%20now(24h)%3C%2FP%3E%3CP%3E%7C%20summarize%20avg(CounterValue)%20by%20bin(TimeGenerated%2C%201h)%2C%20Computer%3C%2FP%3E%3CP%3E%7C%20project%20AvgMemory%3Davg_CounterValue%2C%20Computer%2C%20TimeGenerated%3B%3C%2FP%3E%3CP%3E%2F%2Fend%20memory%3C%2FP%3E%3CP%3E%2F%2Fget%20%25%20of%20CPU%20used%2024%20hours%20bin%20time%20generated%201%20hour%3C%2FP%3E%3CP%3Elet%20CPU%20%3D%20Perf%3C%2FP%3E%3CP%3E%7C%20where%20ObjectName%20%3D%3D%20%22Processor%22%3C%2FP%3E%3CP%3Eand%20InstanceName%20%3D%3D%20%22_Total%22%3C%2FP%3E%3CP%3Eand%20TimeGenerated%20%26lt%3B%20now(24h)%3C%2FP%3E%3CP%3E%7C%20summarize%20avg(CounterValue)%20by%20bin(TimeGenerated%2C%201h)%2C%20Computer%3C%2FP%3E%3CP%3E%7C%20project%20AvgCPU%20%3D%20avg_CounterValue%2C%20Computer%2C%20TimeGenerated%3B%3C%2FP%3E%3CP%3E%2F%2Fend%20cpu%3C%2FP%3E%3CP%3E%2F%2FJoin%20CPU%20query%20with%20AvgMem%20query%20on%20Computer%20name%20column%3C%2FP%3E%3CP%3ECPU%20%7C%20join%20(AvgMem)%20on%20Computer%3C%2FP%3E%3CP%3E%7C%20project%20Computer%2C%20AvgCPU%2C%20AvgMemory%2C%20TimeGenerated%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eif%20you%20find%20you%20don't%20the%20counters%20i've%20used%20or%20you%20want%20to%20try%20different%20ones%20you%20can%20use%20the%20below%20to%20find%20out%20what%20counters%20you%20currently%20have%20in%20your%20environment.%3C%2FP%3E%3CP%3EPerf%20%7C%20distinct%20ObjectName%2C%20CounterName%3C%2FP%3E%3C%2FLINGO-BODY%3E
Sunil Bommala
New Contributor

Hi,

 

How can I get Perf data for the past 24hrs for CPU, Memory, using log analytics so that I can export the data and create CPU chart outside Azure for the past 24hrs. 

7 Replies

Hi Sunil, you didn't give a whole lot to go on, so I made some assumptions. This will get the % of memory in use over the last 24 hours bin by 1 hour and join it with CPU over the last 24 hours also bin by 24 hours.

//get % of memory last 24 hours bin time generated 1 hour

let AvgMem = Perf

| where ObjectName == "Memory"

and CounterName == "% Committed Bytes In Use"

and TimeGenerated < now(24h)

| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer

| project AvgMemory=avg_CounterValue, Computer, TimeGenerated;

//end memory

//get % of CPU used 24 hours bin time generated 1 hour

let CPU = Perf

| where ObjectName == "Processor"

and InstanceName == "_Total"

and TimeGenerated < now(24h)

| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer

| project AvgCPU = avg_CounterValue, Computer, TimeGenerated;

//end cpu

//Join CPU query with AvgMem query on Computer name column

CPU | join (AvgMem) on Computer

| project Computer, AvgCPU, AvgMemory, TimeGenerated

 

if you find you don't the counters i've used or you want to try different ones you can use the below to find out what counters you currently have in your environment.

Perf | distinct ObjectName, CounterName

sorry I forgot, once you're happy with the query and the data you can export the data to CSV as shown in the screen grab. or you can connect PowerBI.2018-08-30_14-33-24.png

Thx for reply. I am looking for help with the query itself. 

 

let startTimestamp = ago(1d);

Perf

| where ContainerName == "platformservices" and CounterName == "% Processor Time"

 

 

'where' operator: Failed to resolve column or scalar expression named 'ContainerName' Support id: 6676cddc-3db3-46ec-bab9-76aeddf5b402

It looks like it can’t find the field “ContainerName”  Make sure the case is correct and ContainerName is part of the Perf Schema. 

Hi There,

 

You can only get below things in Perf query as per schema of this query synatx. I am not sure if you can get any custom thing apart from this.

 

TenantId
Computer
ObjectName
CounterName
InstanceName
CounterValue
TimeGenerated [Central Time (US and Canada)]
SourceSystem

A more concise way to express the same thing without needing to join.

 

Perf
| where (ObjectName == "Memory" and CounterName == "% Committed Bytes In Use")
or (ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total")
and TimeGenerated < now(24h)
| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer, ObjectName
| evaluate pivot(ObjectName, avg(avg_CounterValue))
| project TimeGenerated, Computer, Processor, Memory

 

nice, I knew there had to be a way to summarize multiple values in the same perf query, thanks! and evaluate pivot has been on my short list to understand better. Thanks for that, two birds, one stone.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies