Feb 09 2020 11:59 PM
Feb 09 2020 11:59 PM
Hi Guys, This below document gives very good output of TOP CPU consuming processes from a workspace; https://www.systemcenterautomation.com/…/cpu-processes-azu…/
Has anyone come across similar queries which will provide us the top Memory consuming processes? Please suggest.
Feb 10 2020 12:56 AM
1. You need to tell Log Analytics to collect Perf (or Linux Perf counters) that relate to a process and memory.
Log Analytics - Advanced Settings - Data - "Windows Perf Counter" then type a filter like "process(*)" to see the list
Use the Top query option, like this (sample below) which shows a Top 10 for memory kbytes
Perf | where ObjectName == "Process" | where CounterName == "Used Memory kBytes" | summarize by CounterValue, InstanceName | top 10 by CounterValue desc
From that link you provided, you would need to change the Countername to match the one you selected in step 1 https://www.systemcenterautomation.com/2018/07/cpu-processes-azure-log-analytics/
Oct 11 2020 05:06 AM
riding on this post - can you combine adding memory + cpu usage per each query being running on analysis ?
let window = AzureDiagnostics | where ResourceProvider == "MICROSOFT.ANALYSISSERVICES" and Resource =~ "Server Name"; window | where OperationName has "QueryEnd" or (OperationName has "CommandEnd" and EventSubclass_s == 38) | where EffectiveUsername_s != "NT AUTHORITY\\SYSTEM" | where toint(Duration_s) > toint(5000) | where TimeGenerated > ago(2d) | project EventSubclass_s,TimeGenerated,StartTime_t,EndTime_t,ServerName_s,OperationName,RootActivityId_g,TextData_s,DatabaseName_s,ApplicationName_s,Duration_s,EffectiveUsername_s,User_s | order by StartTime_t asc
Oct 12 2020 12:11 AM
Oct 12 2020 12:19 AM
Oct 12 2020 12:39 AM - edited Oct 12 2020 12:49 AM
To see the data, just click the down arrows after you run any query. Or to log the data and to query it as well, you need to enable the feature I mentioned in my reply. Look at this demo (attached), the first part is using the UI, the second assumes you enable auditing and have LAQueryLogs available to you.
@Sarah_Young , does a nice write up here of the audit feature: https://techcommunity.microsoft.com/t5/azure-sentinel/auditing-azure-sentinel-activities/ba-p/171832...