Jul 05 2018
10:07 AM
- last edited on
Apr 07 2022
05:13 PM
by
TechCommunityAP
Jul 05 2018
10:07 AM
- last edited on
Apr 07 2022
05:13 PM
by
TechCommunityAP
Hi everyone,
Calculating memory and network usage as a percentage of the resource is a classic problem for Windows performance counters. The issue is that the available counters are absolute numbers, but you don't necessarily know the total for these resources on a given machine.
Has anyone come up with a clever way to do this through in OMS and log analytics?
For reference, here is a query I'm using to get the average for Bytes Total/sec:
Jul 06 2018 07:29 AM
SolutionSo this will get you really close on the memory, however it would be much easier if the log analytics just collected this type of hardware inventory data.
its not quite 100% for instance on my hyperv server its ~4gb off, but on another physical server it was less than .5 gb off. Perhaps it will get you started?
let Convert = Perf
| where CounterName == "% Committed Bytes In Use"
| extend Perc = 100 - CounterValue;
let Gigs = Perf
| where CounterName == "Available MBytes"
| extend available_GB = CounterValue / 1024;
Gigs | join (Convert) on Computer
| project Computer, available_GB, Perc, CounterName1, CounterValue1
| extend Total_GB = (available_GB * 100) / Perc
Jul 08 2018 07:00 AM
I think Billy's reply is the best response. Tried to "prettify" it:
let free_memory_percent = Perf | where CounterName == "% Committed Bytes In Use" | summarize arg_max(TimeGenerated, CounterValue) by Computer | project TimeGenerated, Computer, free_memory_percent=100-CounterValue; let free_memory_gigs = Perf | where CounterName == "Available MBytes" | summarize arg_max(TimeGenerated, CounterValue) by Computer | project TimeGenerated, Computer, free_memory_GB=CounterValue/1024; free_memory_gigs | join kind= innerunique(free_memory_percent) on Computer | where time_diff=abs((TimeGenerated-TimeGenerated1)/1m)<1 | project TimeGenerated, Computer, free_memory_percent, free_memory_GB, Total_GB=(free_memory_GB*100)/free_memory_percent
A link to the example on the demo env here.
Jul 11 2018 02:37 PM
Thanks Billy and Noa, this was very helpful.
Jul 06 2018 07:29 AM
SolutionSo this will get you really close on the memory, however it would be much easier if the log analytics just collected this type of hardware inventory data.
its not quite 100% for instance on my hyperv server its ~4gb off, but on another physical server it was less than .5 gb off. Perhaps it will get you started?
let Convert = Perf
| where CounterName == "% Committed Bytes In Use"
| extend Perc = 100 - CounterValue;
let Gigs = Perf
| where CounterName == "Available MBytes"
| extend available_GB = CounterValue / 1024;
Gigs | join (Convert) on Computer
| project Computer, available_GB, Perc, CounterName1, CounterValue1
| extend Total_GB = (available_GB * 100) / Perc