VMInsights - Time Frequency

%3CLINGO-SUB%20id%3D%22lingo-sub-1592820%22%20slang%3D%22en-US%22%3EVMInsights%20-%20Time%20Frequency%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1592820%22%20slang%3D%22en-US%22%3E%3CP%3EJust%20started%20using%20VMinsights%20and%20have%20created%20a%20few%20alerts%20based%20on%20the%20logs%20coming%20into%20the%20Log%20Analytics%20VMProcess%20table.%3C%2FP%3E%0A%3CP%3EMy%20initial%20concern%20is%20that%20each%20Process%20seems%20to%20be%20logged%20just%20once%20an%20hour%2C%20can%20this%20be%20altered%20anywhere%20%3F%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAn%20hour%20seems%20a%20long%20time%20to%20be%20waiting%20to%20see%20if%20a%20Process%20is%20running%20or%20not.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1592820%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAlerts%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Evm%20insights%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1600856%22%20slang%3D%22en-US%22%3ERE%3A%20VMInsights%20-%20Time%20Frequency%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1600856%22%20slang%3D%22en-US%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F452208%22%20target%3D%22_blank%22%3E%40JK_UK%3C%2FA%3E%20the%20product%20group%20of%20VM%20Insights%20were%20informed%20and%20they'll%20respond%20here.%20In%20short%2C%20they%20mentioned%20VMProcess%20is%20a%20metadata%20table%20that's%20not%20intended%20for%20this%20use%2C%20and%20they'll%20share%20how%20it%20should%20be%20done.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1600867%22%20slang%3D%22en-US%22%3ERE%3A%20VMInsights%20-%20Time%20Frequency%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1600867%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54923%22%20target%3D%22_blank%22%3E%40Noa%20Kuperberg%3C%2FA%3E%26nbsp%3BThanks%2C%20I%20look%20forward%20to%20an%20update.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1609940%22%20slang%3D%22en-US%22%3ERE%3A%20VMInsights%20-%20Time%20Frequency%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1609940%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54923%22%20target%3D%22_blank%22%3E%40Noa%20Kuperberg%3C%2FA%3E%26nbsp%3BHi%2C%20any%20update%20on%20this%20%3F%20If%20it's%20not%20the%20VMProcess%20table%20then%20how%20should%20processes%20be%20monitored%20on%20Virtual%20Machines%20%2C%20is%20it%20still%20the%20Perf%20table%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1611831%22%20slang%3D%22en-US%22%3ERE%3A%20VMInsights%20-%20Time%20Frequency%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1611831%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F452208%22%20target%3D%22_blank%22%3E%40JK_UK%3C%2FA%3E%26nbsp%3BYes%2C%20the%20current%20method%20for%20monitoring%20a%20process%20is%20by%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-performance-counters%23configuring-performance-counters%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Esetting%20up%20a%20performance%20counter%20on%20the%20workspace%3C%2FA%3E%20to%20send%20data%20into%20the%20Perf%20table.%26nbsp%3B%20For%20example%2C%20you%20could%20use%26nbsp%3B%3CSPAN%3EProcess(*)%5C%25%20Processor%20Time.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20Noa%20mentioned%2C%20VMProcess%20is%20a%20metadata%20table%20used%20for%20Service%20Map%20an%20Azure%20Monitor%20for%20VMs.%26nbsp%3B%20For%20more%20details%2C%20you%20can%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Finsights%2Fvminsights-log-search%23vmprocess-records%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Esee%20the%20docs%20here%3C%2FA%3E.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Just started using VMinsights and have created a few alerts based on the logs coming into the Log Analytics VMProcess table.

My initial concern is that each Process seems to be logged just once an hour, can this be altered anywhere ? 

An hour seems a long time to be waiting to see if a Process is running or not.

4 Replies
@JK_UK the product group of VM Insights were informed and they'll respond here. In short, they mentioned VMProcess is a metadata table that's not intended for this use, and they'll share how it should be done.

@Noa Kuperberg Thanks, I look forward to an update.

@Noa Kuperberg Hi, any update on this ? If it's not the VMProcess table then how should processes be monitored on Virtual Machines , is it still the Perf table ?

@JK_UK Yes, the current method for monitoring a process is by setting up a performance counter on the workspace to send data into the Perf table.  For example, you could use Process(*)\% Processor Time.

 

As Noa mentioned, VMProcess is a metadata table used for Service Map an Azure Monitor for VMs.  For more details, you can see the docs here.