SOLVED

Automation to start/stop on conditions

Brass Contributor

Hi

I'm trying to perform an OMS automation that works on the following conditions:

Automatically brought online when certain nodes reach one of the following resource utilization levels:

 

Memory 85% for a 2hr duration (5min sampling periods)

 

OR

 

CPU 70% for a 15min duration (5 minute sampling periods)

 

Nodes brought up dynamically will be automatically shutdown at 11:00pm IF the following resource allocations are met: Memory is < 85% Utilization OR CPU < 70% utilization.

 

 

I think for the cpu and/or memory query condition I should create 2 queries:

 

Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory")

| where CounterName == "% Committed Bytes In Use" 

| summarize AverageRAM = avg(CounterValue)  by Computer

| where AverageRAM > 85

 

Perf
| where CounterName == "% Processor Time"
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 70

 

 

and use the OMS workspace Alert to start a runbook with a simple Start-VM.

 

However, i'm struggling with the following:

First, I don't know how to add a between condition with the time. I'm not sure about the syntax. I want to add a between 2 hours ago. 

 

Second, I'm sure I should optimize and summarize both queries into one with one or condition, but, again, i'm struggling with syntax and how should I engage the problem.

 

And last of all

To met the stop condition AND the time of the day, that should be something like "where CPU < 70 or RAM < 85 AND time 11:00 pm"
Am I right?

 

2 Replies
best response confirmed by Dante Nahuel Ciai (Brass Contributor)
Solution

Ok so for the time I understand i should use TimeGenerated ago(120m)

 

So the two queries should look like:

Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory")

| where CounterName == "% Committed Bytes In Use" and TimeGenerated =< ago(120m)

| summarize AverageRAM = avg(CounterValue)  by Computer

| where AverageRAM > 85

 

Perf
| where CounterName == "% Processor Time" and TimeGenerated =< ago(120m)
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 70

 

Am i correct?

Ok I think I made really good progress


So the start up OMS query should be like this:

 

Two queries because both are not dependent on each other, one for CPU and one for RAM

Perf

| where CounterName == "% Committed Bytes In Use" and TimeGenerated > ago(2h)

| where ( Computer == "xxxx" or Computer == "xxxx" )

| summarize average_committed_bytes_percent = avg(CounterValue) by Computer

| where average_committed_bytes_percent > 85

 

That will trigger an alarm when more than 0 results are present
and that will trigger the automation account runbook with a simple start vms powershell script.

 

 

Now the difficult part for me was the Stop VMs part because the request was to only activate it at 11:00 PM

 

So what i did was use a where at the end of the query getting hourofday(now()) == 23
and I think that did it.
Am I correct?

Let me here some opinions.

Best regards

1 best response

Accepted Solutions
best response confirmed by Dante Nahuel Ciai (Brass Contributor)
Solution

Ok so for the time I understand i should use TimeGenerated ago(120m)

 

So the two queries should look like:

Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory")

| where CounterName == "% Committed Bytes In Use" and TimeGenerated =< ago(120m)

| summarize AverageRAM = avg(CounterValue)  by Computer

| where AverageRAM > 85

 

Perf
| where CounterName == "% Processor Time" and TimeGenerated =< ago(120m)
| summarize AverageRAM = avg(CounterValue) by Computer
| where AverageRAM > 70

 

Am i correct?

View solution in original post