memory usage related query

%3CLINGO-SUB%20id%3D%22lingo-sub-1163577%22%20slang%3D%22en-US%22%3Ememory%20usage%20related%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1163577%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Guys%2C%20This%20below%20document%20gives%20very%20good%20output%20of%20TOP%20CPU%20consuming%20processes%20from%20a%20workspace%3B%20%3CA%20href%3D%22https%3A%2F%2Fwww.systemcenterautomation.com%2F%E2%80%A6%2Fcpu-processes-azu%E2%80%A6%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.systemcenterautomation.com%2F%E2%80%A6%2Fcpu-processes-azu%E2%80%A6%2F%20%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHas%20anyone%20come%20across%20similar%20queries%20which%20will%20provide%20us%20the%20top%20Memory%20consuming%20processes%3F%20Please%20suggest.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1163577%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1163657%22%20slang%3D%22en-US%22%3ERe%3A%20memory%20usage%20related%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1163657%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F338025%22%20target%3D%22_blank%22%3E%40roopesh_shetty%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETwo%20things%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E1.%20You%20need%20to%20tell%20Log%20Analytics%20to%20collect%20Perf%20(or%20Linux%20Perf%20counters)%20that%20relate%20to%20a%20%3CSTRONG%3Eprocess%3C%2FSTRONG%3E%20and%20%3CSTRONG%3Ememory%3C%2FSTRONG%3E.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CDIV%20id%3D%22tinyMceEditorClive%20Watson_0%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%3ELog%20Analytics%20-%20Advanced%20Settings%20-%20Data%20-%20%22Windows%20Perf%20Counter%22%20then%20type%20a%20filter%20like%20%22process(*)%22%20to%20see%20the%20list%3C%2FP%3E%0A%3CDIV%20id%3D%22tinyMceEditorClive%20Watson_1%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%3E2.%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUse%20the%20Top%20query%20option%2C%20like%20this%20(sample%20below)%20which%20shows%20a%20Top%2010%20for%20memory%20kbytes%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fms.portal.azure.com%23%4072f988bf-86f1-41af-91ab-2d7cd011db47%2Fblade%2FMicrosoft_Azure_Monitoring_Logs%2FDemoLogsBlade%2FresourceId%2F%252FDemo%2Fsource%2FLogsBlade.AnalyticsShareLinkToQuery%2Fq%2FH4sIAAAAAAAAA03MvQrCMBiF4b3gPRw6d9AL6KKDOKgd1D1Nj1g1iXz5gkS8eAniz%25252F68b0c5Tqon7icKse3PtLoxjmhb1J0EyxjrH1iE5JXyFfvIAWu6IBmXeVa%25252BcUzOGRkfRJ%25252BxGx2X9BSjHBp8HgdzTWyw8lGNtyzLkmq4YTYt3b%25252FDwGhRvQCTJPrbrgAAAA%25253D%25253D%2Ftimespan%2FPT12H%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20run%20query%3C%2FA%3E%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EPerf%0A%7C%20where%20ObjectName%20%3D%3D%20%22Process%22%0A%7C%20where%20CounterName%20%3D%3D%20%22Used%20Memory%20kBytes%22%0A%7C%20summarize%20by%20CounterValue%2C%20InstanceName%0A%7C%20top%2010%20by%20CounterValue%20desc%20%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Ftopoperator%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Ftopoperator%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFrom%20that%20link%20you%20provided%2C%20you%20would%20need%20to%20change%20the%20Countername%20to%20match%20the%20one%20you%20selected%20in%20step%201%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.systemcenterautomation.com%2F2018%2F07%2Fcpu-processes-azure-log-analytics%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.systemcenterautomation.com%2F2018%2F07%2Fcpu-processes-azure-log-analytics%2F%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Hi Guys, This below document gives very good output of TOP CPU consuming processes from a workspace; https://www.systemcenterautomation.com/…/cpu-processes-azu…/

 

Has anyone come across similar queries which will provide us the top Memory consuming processes? Please suggest.

1 Reply
Highlighted

@roopesh_shetty 

 

Two things:

 

1. You need to tell Log Analytics to collect Perf (or Linux Perf counters) that relate to a process and memory.  

 

Log Analytics - Advanced Settings - Data - "Windows Perf Counter" then type a filter like "process(*)" to see the list

 

2. 

Use the Top query option, like this (sample below) which shows a Top 10 for memory kbytes

Go to Log Analytics and run query

Perf
| where ObjectName == "Process"
| where CounterName == "Used Memory kBytes"
| summarize by CounterValue, InstanceName
| top 10 by CounterValue desc 

 

https://docs.microsoft.com/en-us/azure/kusto/query/topoperator 

 

From that link you provided, you would need to change the Countername to match the one you selected in step 1  https://www.systemcenterautomation.com/2018/07/cpu-processes-azure-log-analytics/