May 08 2019
11:48 AM
- last edited on
Apr 07 2022
05:46 PM
by
TechCommunityAP
May 08 2019
11:48 AM
- last edited on
Apr 07 2022
05:46 PM
by
TechCommunityAP
Hi Everyone,
Background: We have more than terabytes of data we've collected over the last week. We've stopped the collection this week. And we now have 30 days to either pull the data and put it somewhere (I'm not sure if that's even possible in LogAnalytics), or we query and get as much information as possible.
We are building out a new VM environment, but the specs are still unknown. We would like to use the data we've collected to the baseline specs.
So how much will each VM processor speeds/core, memory, and hard drive space.
And as a bonus, what process they are running that are being used (im not sure if the performance data will get this.)
May 09 2019 03:14 AM
Hi, what Data Tables do you have, that is more important than your capacity of Logs at this stage?
I'm assuming you have the Perf table? If so what Perf counters are you collecting? This will show the tables in use, can you share the results?
search * | summarize count() by $table | sort by count_ desc
This will all list any counters you have collected:
Perf | summarize count() by CounterName | sort by count_ desc
If you do have Perf, and this specific counter then you can get cores?
// count cores on each computer, exclude _total with regex Perf | where CounterName == "% Processor Time" | where InstanceName matches regex @'[0-9]' | summarize Cores = dcount(InstanceName), CoreList = make_set(InstanceName) by Computer
If you have this table, then you could get cores, speed and memory?
ServiceMapComputer_CL | distinct Computer, Cpus_d, CpuSpeed_d, PhysicalMemory_d | summarize cores = sum(Cpus_d), CpuSpeed = sum(CpuSpeed_d), PhysicalMemeory = sum(PhysicalMemory_d) by Computer
Disk space needs two Perf counters (if you want the in-use and disk capacity)
let myPCT =100; // show all drives = 100 or show only drives below = nn % Perf | where CounterName == "Free Megabytes" | where TimeGenerated > startofday(ago(1d)) | where InstanceName has ":" and strlen(InstanceName) ==2 // only look at drive letters | summarize MbFree=avg(CounterValue) by Computer,InstanceName,bin(TimeGenerated, 5m) | summarize arg_max(TimeGenerated, *) by Computer,InstanceName |join kind= inner ( Perf | where CounterName == "% Free Space" | where TimeGenerated > startofday(ago(1d)) | where InstanceName has ":" and strlen(InstanceName) ==2 // only look at drive letters | summarize PctFree=avg(CounterValue) by Computer,InstanceName,bin(TimeGenerated, 5m) | summarize arg_max(TimeGenerated, *) by Computer,InstanceName ) on Computer , InstanceName | project TotalSizeGB=round(MbFree*100/PctFree/1024,0),round(PctFree,2),round(MbFree,2),Computer,InstanceName | where PctFree <= myPCT // only shows drives with space below this value | summarize FreePCT=avg(PctFree) by Computer,DriveLetter = InstanceName,TotalSizeGB,FreeGB = round(MbFree / 1024,2) | sort by DriveLetter asc
Computer | DriveLetter | TotalSizeGB | FreeGB | FreePCT | |
DC02 | C: | 40 | 18.44 | 46.1 |
If you had VMconnection then this would work to look at Processes?
// show bytes per process by Computer VMConnection | summarize count(BytesSent), count(BytesReceived), make_set(ProcessName) by Computer
May 09 2019 07:35 AM
@CliveWatsonThanks for the suggestions! here's the list that I've been pulling:
When I run the Core Counts its giving me this:
Is that right?
I'm also getting no results for the hard drive space query:
May 09 2019 08:00 AM
He is an updated cores query, that should work better?
// count cores on each computer, exclude _total with regex Perf | where CounterName == "% Processor Time" and ObjectName == "Processor" | where InstanceName matches regex '[0-9]' | summarize Cores = dcount(InstanceName), CoreList = make_set(InstanceName) by Computer
or
Perf | where CounterName == "% Processor Time" and ObjectName == "Processor" | where InstanceName matches regex @'[0-9]' | summarize Cores = dcount(InstanceName) by Computer | sort by Cores desc | render barchart
It doesn't look like you have "free megabytes" counter, so the query just needs to be:
let myPCT = 100; Perf | where CounterName == "% Free Space" | where TimeGenerated > startofday(ago(1d)) | where InstanceName has ":" and strlen(InstanceName) ==2 // only look at drive letters | summarize PctFree=round(avg(CounterValue),2) by Computer,InstanceName | where PctFree <= myPCT | sort by PctFree desc
Jul 06 2020 12:22 PM
Hi @CliveWatson
with the help of below query can I get the Cores Utilization.?
I was refering to the Article : https://docs.microsoft.com/en-us/azure/azure-monitor/platform/metrics-supported
But I couldn't make anything using Metric as well.
// count cores on each computer, exclude _total with regex Perf | where CounterName == "% Processor Time" and ObjectName == "Processor" | where InstanceName matches regex '[0-9]' | summarize Cores = dcount(InstanceName), CoreList = make_set(InstanceName) by Computer
Thanks,
Vinayaka
Jul 06 2020 11:51 PM
// count cores on each computer, exclude _total with regex
Perf
| where CounterName == "% Processor Time" and ObjectName == "Processor"
| where InstanceName matches regex '[0-9]'
| summarize Cores = dcount(InstanceName), pctbyCore= sum(CounterValue) by Computer, InstanceName
// count cores on each computer, exclude _total with regex, every 6 hrs
Perf
| where CounterName == "% Processor Time" and ObjectName == "Processor"
| where InstanceName matches regex '[0-9]'
| summarize Cores = dcount(InstanceName), pctbyCore= sum(CounterValue) by Computer, InstanceName, bin(TimeGenerated,6h)
Mar 09 2021 12:32 PM - edited Mar 09 2021 12:42 PM
Hi @CliveWatson,
can we get the cpu utilization with Process name with kustho query OMS on windows and linux machines?
Thanks,
Vinayaka
Mar 09 2021 01:08 PM
Mar 10 2021 12:12 AM