07-05-2018 10:07 AM
07-05-2018 10:07 AM
Calculating memory and network usage as a percentage of the resource is a classic problem for Windows performance counters. The issue is that the available counters are absolute numbers, but you don't necessarily know the total for these resources on a given machine.
Has anyone come up with a clever way to do this through in OMS and log analytics?
For reference, here is a query I'm using to get the average for Bytes Total/sec:
07-06-2018 07:29 AMSolution
So this will get you really close on the memory, however it would be much easier if the log analytics just collected this type of hardware inventory data.
its not quite 100% for instance on my hyperv server its ~4gb off, but on another physical server it was less than .5 gb off. Perhaps it will get you started?
let Convert = Perf
| where CounterName == "% Committed Bytes In Use"
| extend Perc = 100 - CounterValue;
let Gigs = Perf
| where CounterName == "Available MBytes"
| extend available_GB = CounterValue / 1024;
Gigs | join (Convert) on Computer
| project Computer, available_GB, Perc, CounterName1, CounterValue1
| extend Total_GB = (available_GB * 100) / Perc
07-08-2018 07:00 AM
I think Billy's reply is the best response. Tried to "prettify" it:
let free_memory_percent = Perf | where CounterName == "% Committed Bytes In Use" | summarize arg_max(TimeGenerated, CounterValue) by Computer | project TimeGenerated, Computer, free_memory_percent=100-CounterValue; let free_memory_gigs = Perf | where CounterName == "Available MBytes" | summarize arg_max(TimeGenerated, CounterValue) by Computer | project TimeGenerated, Computer, free_memory_GB=CounterValue/1024; free_memory_gigs | join kind= innerunique(free_memory_percent) on Computer | where time_diff=abs((TimeGenerated-TimeGenerated1)/1m)<1 | project TimeGenerated, Computer, free_memory_percent, free_memory_GB, Total_GB=(free_memory_GB*100)/free_memory_percent
A link to the example on the demo env here.