Feb 09 2020 11:59 PM - last edited on Nov 09 2023 11:10 AM by
Hi Guys, This below document gives very good output of TOP CPU consuming processes from a workspace; https://www.systemcenterautomation.com/…/cpu-processes-azu…/
Has anyone come across similar queries which will provide us the top Memory consuming processes? Please suggest.
Feb 10 2020 12:56 AM
Two things:
1. You need to tell Log Analytics to collect Perf (or Linux Perf counters) that relate to a process and memory.
Log Analytics - Advanced Settings - Data - "Windows Perf Counter" then type a filter like "process(*)" to see the list
2.
Use the Top query option, like this (sample below) which shows a Top 10 for memory kbytes
Go to Log Analytics and run query
Perf
| where ObjectName == "Process"
| where CounterName == "Used Memory kBytes"
| summarize by CounterValue, InstanceName
| top 10 by CounterValue desc
https://docs.microsoft.com/en-us/azure/kusto/query/topoperator
From that link you provided, you would need to change the Countername to match the one you selected in step 1 https://www.systemcenterautomation.com/2018/07/cpu-processes-azure-log-analytics/
Oct 11 2020 05:06 AM
riding on this post - can you combine adding memory + cpu usage per each query being running on analysis ?
let window = AzureDiagnostics
| where ResourceProvider == "MICROSOFT.ANALYSISSERVICES" and Resource =~ "Server Name";
window
| where OperationName has "QueryEnd" or (OperationName has "CommandEnd" and EventSubclass_s == 38)
| where EffectiveUsername_s != "NT AUTHORITY\\SYSTEM"
| where toint(Duration_s) > toint(5000)
| where TimeGenerated > ago(2d)
| project EventSubclass_s,TimeGenerated,StartTime_t,EndTime_t,ServerName_s,OperationName,RootActivityId_g,TextData_s,DatabaseName_s,ApplicationName_s,Duration_s,EffectiveUsername_s,User_s
| order by StartTime_t asc
Oct 12 2020 12:11 AM
Oct 12 2020 12:19 AM
Oct 12 2020 12:20 AM
first - i appreciate your fast replay on this thread,
Yes -i would like to see the CPU and Perf data of the query itself.
how can this be done using my query ?
Oct 12 2020 12:39 AM - edited Oct 12 2020 12:49 AM
To see the data, just click the down arrows after you run any query. Or to log the data and to query it as well, you need to enable the feature I mentioned in my reply. Look at this demo (attached), the first part is using the UI, the second assumes you enable auditing and have LAQueryLogs available to you.
@Sarah_Young , does a nice write up here of the audit feature: https://techcommunity.microsoft.com/t5/azure-sentinel/auditing-azure-sentinel-activities/ba-p/171832...