Physical memory or RAM usage in Percentage

%3CLINGO-SUB%20id%3D%22lingo-sub-762664%22%20slang%3D%22en-US%22%3EPhysical%20memory%20or%20RAM%20usage%20in%20Percentage%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-762664%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Guys%2C%3C%2FP%3E%3CP%3EHow%20to%20monitor%20the%20%25%20Memory%20Used%20(Physical%20memory%20or%20RAM%20usage%20in%20Percentage)%20of%20Windows%20VMs%20in%20Azure%20monitors.%20In%20Log%20analytics%20workspace%20all%20I%20can%20see%20is%20%E2%80%9C%3CSTRONG%3EAvailable%20Mbytes%3C%2FSTRONG%3E%E2%80%9D%20and%20%E2%80%9C%3CSTRONG%3E%25%20Committed%20Bytes%20In%20Use%3C%2FSTRONG%3E%E2%80%9D%20counters%20whose%20values%20are%20not%20matching%20my%20requirement.%20Anyone%20else%20is%20using%20any%20workarounds%20for%20this%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-762664%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-762890%22%20slang%3D%22en-US%22%3ERe%3A%20Physical%20memory%20or%20RAM%20usage%20in%20Percentage%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-762890%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F338025%22%20target%3D%22_blank%22%3E%40roopesh_shetty%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThere%20is%20similar%20solution%20for%20Disk%20Space%20in%20Use%20and%20Capacity.%26nbsp%3B%20Which%20looks%20like%20this%20for%20%3CSTRONG%3EMemory%3C%2FSTRONG%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EPerf%0A%2F%2F%7C%20where%20Computer%20startswith%20%22DC02%22%20%0A%2F%2F%20add%20other%20computers%20here%0A%7C%20where%20ObjectName%20%3D%3D%20%22Memory%22%20%0A%7C%20where%20CounterName%20%3D%3D%20%22Available%20MBytes%22%0A%7C%20summarize%20GBFree%3Davg(CounterValue)%20by%20Computer%2Cbin(TimeGenerated%2C%205m)%0A%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%0A%7Cjoin%20kind%3D%20inner%0A(%0A%20%20%20%20Perf%0A%20%20%20%20%7C%20where%20ObjectName%20%3D%3D%20%22Memory%22%20%0A%20%20%20%20%7C%20where%20CounterName%20%3D%3D%20%22%25%20Committed%20Bytes%20In%20Use%22%0A%20%20%20%20%7C%20summarize%20PctFree%3Davg(CounterValue)%20by%20Computer%2Cbin(TimeGenerated%2C%205m)%0A%20%20%20%20%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%0A)%0Aon%20Computer%20%0A%7C%20project%20%20%20TotalSizeGB%3Dround(GBFree*100%2FPctFree%2C0)%2C%20%0A%20%20%20%20%20%20%20%20%20%20%20%20round(PctFree%2C2)%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20round(GBFree%2C2)%2C%20%0A%20%20%20%20%20%20%20%20%20%20%20%20Computer%0A%7C%20summarize%20FreePCT%3Davg(PctFree)%20by%20Computer%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20TotalSizeGB%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20FreeGB%20%3D%20round(GBFree%20%2F%201024%2C2)%3C%2FPRE%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fportal.loganalytics.io%2FDemo%3Fq%3DH4sIAAAAAAAAA6VRTUvEMBC9F%252FofhoLQLoV2Fz32YBcsHlYLrl4lbcc1a5Msabpa8ceb9GO3LYKCOSWZ9968N5OifLGtIABSFCDUK0rIBTvUCmUF%252BoW29QXv5gL32R5zdUcYQhSBs0EmZOPAGbAWNde8E%252BL6SGhJshJhEzcKK8dAq5oxIuknQhLfSMSIHHduz3wiZY0eZI2W6jz4GeXuljJMkKMkCgsfrpg3FSJy98zIxxy3mChpyl5QDm%252BUFxFQzs2Xa1ugT9oOwdx%252BzToGzfNemGaMKt0d2sBwy%252BGxQmegnS2nufpH%252BLnaHwegmYKf3u3iDlKYoFpvKxQpH7RaEkdSOyrcbj%252BLZRgGvV0%252F9Px%252BBsPpoEN95fk%252FlTslU52xR8sZxTHgdL1th9MrT%252BcyFRk5n1UMM4khmtiAAJbh6lK7sb4BTErS%252FP0CAAA%253D%26amp%3Btimespan%3DP1D%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20Run%20Query%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHowever%20you%20will%20need%20some%20other%20data%20points.%26nbsp%3B%20As%20the%20results%20look%20like%20this%20(just%20filtered%20on%20a%20single%20VM%20for%20ease)%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fportal.loganalytics.io%2FDemo%3Fq%3DH4sIAAAAAAAAA6VRQUvDMBi9F%252FYfPgpCOwrthh57sAWrh2nB6XWk6%252BeW2SQjSTcn%252FniTrd3aIiiYU5LvvZf3XnKUbyMnDIGUJQi9RglLwba1RqnAnHDkfMHebiBt7kFpIrXaU70GNxVcCyXuhcZq6sIF%252FVRscKkfCUOIY3BnyIQ8dAGpqLlROyNud4RWpKgQZslBo3ItVNWMEUk%252FEbLkTiLGZLfyGuYrqWr0oTicnQUF5d6cMsyQoyQaywBumN8XInK1YORjiBv3lAxlIyiHd8rLGCjn9sobOWBWfqzM7n7N2gUN817ZxxjV5nU4BoYHDi8K3ZZ2sZwv9T%252FCD9X%252BWIBhCn75dFviVgob1OjNhSbVs1HLklgaR6V3%252Bp%252FxJIrCxm4Q%252BUHTQbtO0HY%252B9YOfxiclOx2wO5%252FTiWPBeTo%252FltMo93vpi3ScDyaWmSUQ92xACJNoem3cON9Y8JqfKwMAAA%253D%253D%26amp%3Btimespan%3DP1D%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20Run%20Query%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CDIV%3E%0A%3CTABLE%20cellspacing%3D%221%22%20cellpadding%3D%225%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTH%3EComputer%3C%2FTH%3E%0A%3CTH%3ETotalSizeGB%3C%2FTH%3E%0A%3CTH%3EFreeGB%3C%2FTH%3E%0A%3CTH%3EFreePCT%3C%2FTH%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3EContosoHotel2%3C%2FTD%3E%0A%3CTD%3E204%3C%2FTD%3E%0A%3CTD%3E0.17%3C%2FTD%3E%0A%3CTD%3E87.45%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20final%20two%20columns%20are%20right%2C%20but%20the%20%22TotalSizeGB%22%20isn't%20right%26nbsp%3B%20-%20you%20need%20to%20also%20subtract%20from%20that%20number%20the%20%3CSTRONG%3ECached%20Memory%3C%2FSTRONG%3Eand%20the%20%3CSTRONG%3EPaged%20Pool%3C%2FSTRONG%3Eand%20the%20%3CSTRONG%3ENon_paged%20Pool%3C%2FSTRONG%3E%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20see%20those%203%20fields%20from%20Task%20Manager%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20660px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F123643i335D58BF98991EAF%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22DC02.png%22%20title%3D%22DC02.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThat's%20as%20far%20as%20I%20have%20time%20for%20now%3B%20I%20suspect%20we%20need%20a%20different%20counter%20or%203%20more%20counters.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMaybe%20you%20are%20ok%20with%20the%20result%2C%20its%20not%20Physical%20RAM%20(as%20you%20asked%20for)%20but%20Total%20Available%20RAM%20inc%20cached%20etc...%3CBR%20%2F%3EFreePCT%20(Free%20%25)%20is%20correct%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-764041%22%20slang%3D%22en-US%22%3ERe%3A%20Physical%20memory%20or%20RAM%20usage%20in%20Percentage%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-764041%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%20%3B%3C%2FP%3E%3CP%3Ei%20ran%20this%20query%20but%20it%20gives%20the%20exact%20value%20for%20%3CSTRONG%3EFreeGB%3C%2FSTRONG%3Eand%20the%20values%20for%20%3CSTRONG%3ETotalSizeGB%3C%2FSTRONG%3Eand%20%3CSTRONG%3EFreePCT%3C%2FSTRONG%3Eare%20not%20accurate.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-764332%22%20slang%3D%22en-US%22%3ERe%3A%20Physical%20memory%20or%20RAM%20usage%20in%20Percentage%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-764332%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F338025%22%20target%3D%22_blank%22%3E%40roopesh_shetty%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMostly%20It%20looks%20correct%20to%20me%2C%20what%20time%20are%20you%20scoping%20the%20query%20on%20(default%20is%2024hrs)%2C%20are%20the%20numbers%20higher%20or%20lower%20than%20expected%3F%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ETotalSizeGB%3C%2FSTRONG%3Eis%20wrong%20-%20I%20mentioned%20that%2C%20I'll%20let%20you%20find%20the%20correct%20counter(s)%20or%20method%20for%20that.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20query%20is%20a%20sample%20of%20the%20technique%20not%20the%20finished%20solution%20-%20so%20it%20might%20need%20some%20adjustment%20-%20sorry%20I%20didn't%20make%20that%20clearer%20in%20my%20response%20(it%20comes%20from%20a%20similar%20solution%20with%20disk%20space%2C%20where%20averages%20work%20fine%2C%20and%20the%20data%20fluctuates%20less).%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20query%20uses%20averages%20where%20as%20if%20you%20look%20at%20Task%20Manager%20for%20example%20you%20get%20the%20actuals%2Favg%20over%20a%20small%20time%20window.%26nbsp%3B%20The%20query%20is%20also%20time-wise%20behind%20the%20real%20machines%20(ingestion%20time%20delays%20etc...).%26nbsp%3B%20In%20my%20case%20I%20used%20an%20RDS%20server%20and%20a%20DC%20that%20I%20know%20are%20pretty%20stable.%26nbsp%3B%20%26nbsp%3BFreeGb%20and%20PctFree%20seem%20ok%2C%20but%20I've%20not%20looked%20at%20them%20for%20very%20long.%26nbsp%3B%20If%20your%20servers%20are%20busy%20and%20the%20values%20are%20fluctuating%20and%20you%20are%20measuring%20over%2024hrs%20for%20instance%20then%20the%20averages%20maybe%20%3CEM%3Every%3C%2FEM%3Edifferent%2C%20perhaps%20scope%20to%20the%20last%20hour%20or%20even%20use%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fbetweenoperator%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ebetween%3C%2FA%3Eoperator%20to%20scope%20accurately.%26nbsp%3B%20You%20may%20need%20to%20change%20the%20query%20from%20avg%20to%20max%20or%20whatever%20aggregation%20you%20require.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThank%20you%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Hi Guys,

How to monitor the % Memory Used (Physical memory or RAM usage in Percentage) of Windows VMs in Azure monitors. In Log analytics workspace all I can see is “Available Mbytes” and “% Committed Bytes In Use” counters whose values are not matching my requirement. Anyone else is using any workarounds for this?

3 Replies

@roopesh_shetty 

 

There is similar solution for Disk Space in Use and Capacity.  Which looks like this for Memory:

 

Perf
//| where Computer startswith "DC02" 
// add other computers here
| where ObjectName == "Memory" 
| where CounterName == "Available MBytes"
| summarize GBFree=avg(CounterValue) by Computer,bin(TimeGenerated, 5m)
| summarize arg_max(TimeGenerated, *) by Computer
|join kind= inner
(
    Perf
    | where ObjectName == "Memory" 
    | where CounterName == "% Committed Bytes In Use"
    | summarize PctFree=avg(CounterValue) by Computer,bin(TimeGenerated, 5m)
    | summarize arg_max(TimeGenerated, *) by Computer
)
on Computer 
| project   TotalSizeGB=round(GBFree*100/PctFree,0), 
            round(PctFree,2),
            round(GBFree,2), 
            Computer
| summarize FreePCT=avg(PctFree) by Computer,
            TotalSizeGB,
            FreeGB = round(GBFree / 1024,2)

Go to Log Analytics and Run Query

 

However you will need some other data points.  As the results look like this (just filtered on a single VM for ease)


Go to Log Analytics and Run Query

Computer TotalSizeGB FreeGB FreePCT
ContosoHotel2 204 0.17 87.45
 

 

The final two columns are right, but the "TotalSizeGB" isn't right  - you need to also subtract from that number the Cached Memory and the Paged Pool and the Non_paged Pool  

 

You can see those 3 fields from Task Manager:

 

DC02.png

 

That's as far as I have time for now; I suspect we need a different counter or 3 more counters.

 

Maybe you are ok with the result, its not Physical RAM (as you asked for) but Total Available RAM inc cached etc...
FreePCT (Free %) is correct

 

@Clive Watson  ;

i ran this query but it gives the exact value for FreeGB and the values for TotalSizeGB and FreePCT are not accurate.

 

Hello @roopesh_shetty 

 

Mostly It looks correct to me, what time are you scoping the query on (default is 24hrs), are the numbers higher or lower than expected?

TotalSizeGB is wrong - I mentioned that, I'll let you find the correct counter(s) or method for that. 

 

The query is a sample of the technique not the finished solution - so it might need some adjustment - sorry I didn't make that clearer in my response (it comes from a similar solution with disk space, where averages work fine, and the data fluctuates less).  

The query uses averages where as if you look at Task Manager for example you get the actuals/avg over a small time window.  The query is also time-wise behind the real machines (ingestion time delays etc...).  In my case I used an RDS server and a DC that I know are pretty stable.   FreeGb and PctFree seem ok, but I've not looked at them for very long.  If your servers are busy and the values are fluctuating and you are measuring over 24hrs for instance then the averages maybe very different, perhaps scope to the last hour or even use the between operator to scope accurately.  You may need to change the query from avg to max or whatever aggregation you require. 

 

Thank you