Creat a query to get CPU usage from every process on the VM

Occasional Contributor

Hi,

 

I'm trying to get the CPU usage from every process on my vm is that possible with log analytics? I can't seem to get it.  It seems I need to convert the counter value i'm getting to percentage usage but I can't find the way to do it.

This is what I have until now.
Perf
| where TimeGenerated > now(-30m)
and ObjectName == "Process"
and CounterName == "% Processor Time"
and InstanceName != "_Total"
and InstanceName != "Idle"
and CounterValue > 5
| project Computer, ObjectName, CounterName, InstanceName, CounterValue, TimeGenerated

4 Replies

@david1718 

 

CounterValue is a % (percentage), so for this Computer, here are the top 10 counters over 5% (which you defined), the top one being 14.4%.

Perf
| where TimeGenerated > now(-30m)
| where Computer startswith "SQL01"
    and ObjectName == "Process"
    and CounterName == "% Processor Time"
    and InstanceName != "_Total"
    and InstanceName != "Idle"
    and CounterValue > 5
| project Computer, ObjectName, CounterName, InstanceName, CounterValue, TimeGenerated
| top 10 by CounterValue
| order by CounterValue desc

Go to Log Analytics and run query 

Clive_Watson_0-1647872187981.png

 



@Clive_Watson 

 

Hi, thanks for the reply, but I was looking for something looking like this:

EXAMPLE

david1718_0-1647874514454.png

 

@david1718 

 

Perf
| where TimeGenerated > now(-30m)
| where Computer startswith "SQL01"
    and ObjectName == "Process"
    and CounterName == "% Processor Time"
    and InstanceName != "_Total"
    and InstanceName != "Idle"
    and CounterValue > 5
| summarize TotalCPU = sum(CounterValue), avgCPU = avg(CounterValue) by InstanceName,Computer
| order by TotalCPU desc

like this?

Clive_Watson_0-1647875993493.png

 

Yes, something like that. I tried the query and its returning a avgCPU of 40% with the sum of all processes but in the CPU trend graph with the MAX and avg option it shows that the max porcentage is 10%. Are we getting the correct data from de log analytics query?