SOLVED
Home

create a search query for the Average of CPU over 15 mins .. and set alert to it

%3CLINGO-SUB%20id%3D%22lingo-sub-161325%22%20slang%3D%22en-US%22%3Ecreate%20a%20search%20query%20for%20the%20Average%20of%20CPU%20over%2015%20mins%20..%20and%20set%20alert%20to%20it%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-161325%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20am%20trying%20to%20create%20some%20monitoring%20based%20on%20OMS%20Queries%20one%20of%20the%20them%20is%20creating%20an%20alert%20if%20the%20average%20CPU%20Utilization%20over%2015%20mins%20was%20more%20than%2090%25%20..%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Ewhen%20i%20use%20this%20query%20what%20i%20think%20it%20is%20doing%20is%20getting%20all%20the%20entries%20that%26nbsp%3Bare%20more%20than%2090%20and%20get%20the%20average%20of%20them%2C%20but%20what%20i%20want%20is%20to%20get%20all%20the%20measures%20and%20based%20on%20the%20average%20of%20them%20if%20its%20more%20than%2090%20return%20results%20so%20i%20can%20create%20alerts%20based%20on%20that.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Ekeep%20in%20consideration%20im%20using%20the%20OMS%20search%20query%20not%20the%20advanced%20analytics.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPerf%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20ago(15m)%20%3CBR%20%2F%3E%7C%20where%20(%20ObjectName%20%3D%3D%20%22Processor%20Information%22%20)%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%20and%20InstanceName%20%3D%3D%20%22_Total%22%3CBR%20%2F%3E%7C%20where%20CounterValue%20%26gt%3B%2090%3CBR%20%2F%3E%7C%20summarize%20avg(CounterValue)%20by%20Computer%3CBR%20%2F%3E%7C%20render%20table%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Ehelp%20appreciated%20%3A)%3C%2Fimg%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%3C%2FP%3E%0A%3CP%3EAhmed%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-161325%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-363124%22%20slang%3D%22en-US%22%3ERe%3A%20create%20a%20search%20query%20for%20the%20Average%20of%20CPU%20over%2015%20mins%20..%20and%20set%20alert%20to%20it%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-363124%22%20slang%3D%22en-US%22%3E%3CP%3EWhich%20counters%20you%20will%20use%20depends%20on%20your%20requirements%20otherwise%20the%20query%20is%20general%20enough%20to%20be%20modified%20to%20work%20with%20other%20counters.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-362742%22%20slang%3D%22en-US%22%3ERe%3A%20create%20a%20search%20query%20for%20the%20Average%20of%20CPU%20over%2015%20mins%20..%20and%20set%20alert%20to%20it%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-362742%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Stanislav%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20using%20the%20ObjectName%20%3D%3D%20%22Processor%22%20for%20this%20query%2C%20hope%20it%20is%20the%20same%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3EPerf%0A%7C%20where%20%20ObjectName%20%3D%3D%20%22Processor%20Information%22%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%20and%20InstanceName%20%3D%3D%20%22_Total%22%0A%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%20by%20Computer%2C%20bin(TimeGenerated%2C%2015m)%0A%7C%20where%20AggregatedValue%20%26gt%3B%2090%0A%7C%20render%20table%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-214907%22%20slang%3D%22en-US%22%3ERe%3A%20create%20a%20search%20query%20for%20the%20Average%20of%20CPU%20over%2015%20mins%20..%20and%20set%20alert%20to%20it%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-214907%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3EI%20am%20not%20quite%20sure%20what%20you%20want%20to%20achieve.%20If%20I%20understand%20correctly%20may%20be%20this%3A%3C%2FP%3E%0A%3CPRE%3EPerf%0A%7C%20where%20%20ObjectName%20%3D%3D%20%22Processor%20Information%22%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%20and%20InstanceName%20%3D%3D%20%22_Total%22%0A%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%20by%20Computer%2C%20bin(TimeGenerated%2C%2015m)%0A%7C%20where%20AggregatedValue%20%26gt%3B%2090%0A%7C%20render%20table%3C%2FPRE%3E%0A%3CP%3EYou%20can%20also%20render%20timechart%20but%20the%20visualization%20will%20not%20be%20pretty%20as%20it%20will%20show%20only%20periods%20where%20the%20machines%20were%20above%2090.%20Because%20such%20visualization%20is%20not%20pretty%20I%20am%20not%20sure%20if%20this%20is%20thing%20you%20want%20to%20achieve.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-214311%22%20slang%3D%22en-US%22%3ERe%3A%20create%20a%20search%20query%20for%20the%20Average%20of%20CPU%20over%2015%20mins%20..%20and%20set%20alert%20to%20it%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-214311%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3CBR%20%2F%3EI%20need%20the%20exact%20same%20query%2C%20for%20for%20visualization%2C%20not%20for%20alerting.%3CBR%20%2F%3EI%20cannot%20figure%20out%20how%20to%20only%26nbsp%3Badd%20it%20to%20the%20result%20table%2Fvisualization%20if%20%3CSPAN%3Ethe%20average%20CPU%20Utilization%20over%2015%20mins%20was%20more%20than%2090%25.%20What's%20the%20best%20way%20to%20do%20this%3F%3CBR%20%2F%3ERegards%2C%3CBR%20%2F%3ENikolaj%3C%2FSPAN%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F9172%22%20target%3D%22_blank%22%3E%40Stanislav%20Zhelyazkov%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-162037%22%20slang%3D%22en-US%22%3ERe%3A%20create%20a%20search%20query%20for%20the%20Average%20of%20CPU%20over%2015%20mins%20..%20and%20set%20alert%20to%20it%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-162037%22%20slang%3D%22en-US%22%3EThanks%20alot%20for%20your%20response%20and%20clarification%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-162025%22%20slang%3D%22en-US%22%3ERe%3A%20create%20a%20search%20query%20for%20the%20Average%20of%20CPU%20over%2015%20mins%20..%20and%20set%20alert%20to%20it%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-162025%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%0A%3CP%3EYes%20with%20this%20query%20you%20are%20getting%20the%20results%20for%20all%20results%20that%20are%20above%2090%20which%20is%20not%20the%20thing%20you%20want%20to%20achieve.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20correct%20way%20to%20get%20the%20computers%20with%20above%2090%20%25%20is%20this%3A%3C%2FP%3E%0A%3CPRE%3EPerf%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(15m)%20%0A%7C%20where%20(%20ObjectName%20%3D%3D%20%22Processor%20Information%22%20)%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%20and%20InstanceName%20%3D%3D%20%22_Total%22%0A%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%20by%20Computer%0A%7C%20where%20AggregatedValue%20%26gt%3B%2090%0A%7C%20render%20table%3C%2FPRE%3E%0A%3CP%3EBecause%20you%20will%20be%20using%20this%20in%20alert%20there%20are%20a%20few%20things%20you%20want%20to%20change.%3C%2FP%3E%0A%3CP%3EFirst%20you%20will%20remove%20the%20filter%20on%20TimeGenerated.%20When%20creating%20alert%20you%20can%20specify%20the%26nbsp%3Bperiod%20(time%20frame)%20of%20the%20alert.%20There%20you%20will%20specify%2015%20mins.%20Second%20you%20do%20not%20need%20to%20filter%20on%20Aggregated%20Value%20from%20alerts%20by%20choosing%20this%20to%20be%20metric%20alert%20there%20you%20can%20configure%20the%20threshold.%20You%20also%20do%20not%20need%20render%20as%20alerts%20do%20not%20use%20it.%20At%20last%20you%20will%20have%20to%20add%20bin()%20function%20that%20will%20match%20the%20period%20(time%20frame)%20in%20your%20case%2015%20mins.%20The%20end%20result%20is%20this%20query%20that%20you%20can%20use%20to%20create%20alert%3A%3C%2FP%3E%0A%3CPRE%3EPerf%0A%7C%20where%20%20ObjectName%20%3D%3D%20%22Processor%20Information%22%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%20and%20InstanceName%20%3D%3D%20%22_Total%22%0A%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%20by%20Computer%2C%20bin(TimeGenerated%2C%2015m)%3C%2FPRE%3E%3C%2FLINGO-BODY%3E
Ahmed Atef
Contributor

Hi all 

 

I am trying to create some monitoring based on OMS Queries one of the them is creating an alert if the average CPU Utilization over 15 mins was more than 90% .. 

 

when i use this query what i think it is doing is getting all the entries that are more than 90 and get the average of them, but what i want is to get all the measures and based on the average of them if its more than 90 return results so i can create alerts based on that. 

 

keep in consideration im using the OMS search query not the advanced analytics. 

 

Perf
| where TimeGenerated > ago(15m)
| where ( ObjectName == "Processor Information" ) and CounterName == "% Processor Time" and InstanceName == "_Total"
| where CounterValue > 90
| summarize avg(CounterValue) by Computer
| render table

 

help appreciated :) 

 

Thanks

Ahmed

6 Replies
Solution

Hi

Yes with this query you are getting the results for all results that are above 90 which is not the thing you want to achieve.

 

The correct way to get the computers with above 90 % is this:

Perf
| where TimeGenerated > ago(15m) 
| where ( ObjectName == "Processor Information" ) and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AggregatedValue = avg(CounterValue) by Computer
| where AggregatedValue > 90
| render table

Because you will be using this in alert there are a few things you want to change.

First you will remove the filter on TimeGenerated. When creating alert you can specify the period (time frame) of the alert. There you will specify 15 mins. Second you do not need to filter on Aggregated Value from alerts by choosing this to be metric alert there you can configure the threshold. You also do not need render as alerts do not use it. At last you will have to add bin() function that will match the period (time frame) in your case 15 mins. The end result is this query that you can use to create alert:

Perf
| where  ObjectName == "Processor Information" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AggregatedValue = avg(CounterValue) by Computer, bin(TimeGenerated, 15m)
Thanks alot for your response and clarification

Hi,
I need the exact same query, for for visualization, not for alerting.
I cannot figure out how to only add it to the result table/visualization if the average CPU Utilization over 15 mins was more than 90%. What's the best way to do this?
Regards,
Nikolaj

@Stanislav Zhelyazkov

Hi,

I am not quite sure what you want to achieve. If I understand correctly may be this:

Perf
| where  ObjectName == "Processor Information" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AggregatedValue = avg(CounterValue) by Computer, bin(TimeGenerated, 15m)
| where AggregatedValue > 90
| render table

You can also render timechart but the visualization will not be pretty as it will show only periods where the machines were above 90. Because such visualization is not pretty I am not sure if this is thing you want to achieve.

Hi Stanislav, 

 

We are using the ObjectName == "Processor" for this query, hope it is the same ?

 

Perf
| where  ObjectName == "Processor Information" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AggregatedValue = avg(CounterValue) by Computer, bin(TimeGenerated, 15m)
| where AggregatedValue > 90
| render table

 

Which counters you will use depends on your requirements otherwise the query is general enough to be modified to work with other counters.