CPU, Memory and Hard Drive Baseline Specs

Brass Contributor

Hi Everyone,

 

Background: We have more than terabytes of data we've collected over the last week. We've stopped the collection this week. And we now have 30 days to either pull the data and put it somewhere (I'm not sure if that's even possible in LogAnalytics), or we query and get as much information as possible.
We are building out a new VM environment, but the specs are still unknown. We would like to use the data we've collected to the baseline specs.

 

So how much will each VM processor speeds/core, memory, and hard drive space.

And as a bonus, what process they are running that are being used (im not sure if the performance data will get this.)

 

 

8 Replies

@rockypabillore 

 

Hi, what Data Tables do you have, that is more important than your capacity of Logs at this stage?

 

I'm assuming you have the Perf table?  If so what Perf counters are you collecting?   This will show the tables in use, can you share the results?

 

search *
| summarize count() by $table
| sort by count_ desc  

This will all list any counters you have collected:

Perf
| summarize count() by CounterName
| sort by count_ desc  

 

 

 

 

If you do have Perf, and this specific counter then you can get cores?

 

// count cores on each computer, exclude _total with regex
Perf
| where CounterName == "% Processor Time"
| where InstanceName matches regex @'[0-9]'
| summarize Cores = dcount(InstanceName), CoreList = make_set(InstanceName) by  Computer

If you have this table, then you could get cores, speed and memory?

 

 

ServiceMapComputer_CL
| distinct Computer, Cpus_d, CpuSpeed_d, PhysicalMemory_d
| summarize cores = sum(Cpus_d),
            CpuSpeed = sum(CpuSpeed_d),
            PhysicalMemeory = sum(PhysicalMemory_d) 
  by Computer 

 

Disk space needs two Perf counters (if you want the in-use and disk capacity)

 

let myPCT =100;  // show all drives = 100 or show only drives below = nn %
Perf
| where CounterName == "Free Megabytes"
| where TimeGenerated > startofday(ago(1d))
| where InstanceName has ":" and strlen(InstanceName) ==2
// only look at drive letters
| summarize MbFree=avg(CounterValue) by Computer,InstanceName,bin(TimeGenerated, 5m)
| summarize arg_max(TimeGenerated, *) by Computer,InstanceName
|join kind= inner
(
    Perf
    | where CounterName == "% Free Space"
    | where TimeGenerated > startofday(ago(1d))
    | where InstanceName has ":" and strlen(InstanceName) ==2
    // only look at drive letters
| summarize PctFree=avg(CounterValue) by Computer,InstanceName,bin(TimeGenerated, 5m)
| summarize arg_max(TimeGenerated, *) by Computer,InstanceName
)
on Computer , InstanceName
| project   TotalSizeGB=round(MbFree*100/PctFree/1024,0),round(PctFree,2),round(MbFree,2),Computer,InstanceName
| where PctFree <= myPCT
// only shows drives with space below this value
| summarize FreePCT=avg(PctFree) by Computer,DriveLetter = InstanceName,TotalSizeGB,FreeGB = round(MbFree / 1024,2)
| sort by DriveLetter  asc
 
Example output
  Computer DriveLetter TotalSizeGB FreeGB FreePCT
DC02 C: 40 18.44 46.1

 

 

If you had VMconnection then this would work to look at Processes?

 

 

// show bytes per process by Computer
VMConnection
| summarize count(BytesSent), count(BytesReceived), make_set(ProcessName)  by  Computer

 

 

 

@CliveWatsonThanks for the suggestions! here's the list that I've been pulling: image.pngimage.png

 

When I run the Core Counts its giving me this:

image.png

 

Is that right?

 

I'm also getting no results for the hard drive space query:

 

image.png

 

Hi @rockypabillore 

 

He is an updated cores query, that should work better? 

// count cores on each computer, exclude _total with regex
Perf
| where CounterName == "% Processor Time"  and ObjectName == "Processor"
| where InstanceName matches regex '[0-9]'
| summarize Cores = dcount(InstanceName), CoreList = make_set(InstanceName) by  Computer

or

Perf
| where CounterName == "% Processor Time" and ObjectName == "Processor"
| where InstanceName matches regex @'[0-9]'
| summarize Cores = dcount(InstanceName) by  Computer
| sort by Cores desc 
| render barchart 

 

It doesn't look like you have "free megabytes" counter, so the query just needs to be:

 

let myPCT = 100;
Perf
| where CounterName == "% Free Space"
| where TimeGenerated > startofday(ago(1d))
| where InstanceName has ":" and strlen(InstanceName) ==2
// only look at drive letters
| summarize PctFree=round(avg(CounterValue),2) by Computer,InstanceName
| where PctFree <= myPCT
| sort by PctFree  desc 

 

Hi @CliveWatson 

 

with the help of below query can I get the Cores Utilization.?

I was refering to the Article : https://docs.microsoft.com/en-us/azure/azure-monitor/platform/metrics-supported

 

But I couldn't make anything using Metric as well.

 

// count cores on each computer, exclude _total with regex
Perf
| where CounterName == "% Processor Time"  and ObjectName == "Processor"
| where InstanceName matches regex '[0-9]'
| summarize Cores = dcount(InstanceName), CoreList = make_set(InstanceName) by  Computer

 Thanks,

Vinayaka 

@Vinayaka2210 

// count cores on each computer, exclude _total with regex
Perf
| where CounterName == "% Processor Time"  and ObjectName == "Processor"
| where InstanceName matches regex '[0-9]'
| summarize Cores = dcount(InstanceName), pctbyCore= sum(CounterValue) by  Computer, InstanceName


// count cores on each computer, exclude _total with regex, every 6 hrs 
Perf
| where CounterName == "% Processor Time"  and ObjectName == "Processor"
| where InstanceName matches regex '[0-9]'
| summarize Cores = dcount(InstanceName), pctbyCore= sum(CounterValue) by  Computer, InstanceName, bin(TimeGenerated,6h)

Hi @CliveWatson,

can we get the cpu utilization with Process name with kustho query OMS on windows and linux machines?

Thanks,
Vinayaka

Hi @CliveWatson,

from the above query how " Cores = dcount(InstanceName) " is considered with Instance Name.

I mean how cores is calculated with count of Instance Name.

Thanks,
Vinayaka
I think this was an example for a larger query, if you wanted to list the cores and count them then you can use:

Perf
| where CounterName == "% Processor Time" and ObjectName == "Processor"
| where InstanceName matches regex '[0-9]'
| summarize listCores = make_set(InstanceName), countCores = dcount(InstanceName) by Computer