SOLVED

Does this query CPU percentage or something else ?

%3CLINGO-SUB%20id%3D%22lingo-sub-3062583%22%20slang%3D%22en-US%22%3EDoes%20this%20query%20CPU%20percentage%20or%20something%20else%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3062583%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20using%20the%20following%20query%20to%20determine%20CPU%20Percentage%20and%20raise%20alert%2C%20but%20I%20am%20not%20sure%20if%20this%20is%20the%20right%20query%20%3A%26nbsp%3B%3C%2FP%3E%3CP%3EPerf%3CBR%20%2F%3E%7C%20where%20_ResourceId%20!contains%20%22prep%22%20and%20_ResourceId%20!contains%20%22demo%22%3CBR%20%2F%3E%7C%20where%20_ResourceId%20contains%20%22abc%22%3CBR%20%2F%3E%7C%20where%20ObjectName%20%3D%3D%20%22Processor%22%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%3CBR%20%2F%3E%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%20by%20bin_at(TimeGenerated%2C%2030m)%2C%20Computer%3CBR%20%2F%3E%7C%20where%20AggregatedValue%20%26gt%3B%2090%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

We are using the following query to determine CPU Percentage and raise alert, but I am not sure if this is the right query : 

Perf
| where _ResourceId !contains "prep" and _ResourceId !contains "demo"
| where _ResourceId contains "abc"
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize AggregatedValue = avg(CounterValue) by bin_at(TimeGenerated, 30m), Computer
| where AggregatedValue > 90

1 Reply
best response confirmed by bkislay (New Contributor)
Solution

@bkislay 

 

You can also look at percentiles https://docs.microsoft.com/en-gb/azure/data-explorer/kusto/query/percentiles-aggfunction#examples (see 2nd example) and the other CPU example in the UI

// CPU usage trends over the last day 
// Calculate CPU usage patterns across all computers, chart by percentiles. 
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize percentiles(CounterValue, 50, 90, 99) by bin(TimeGenerated, 1h)
| render timechart

 You can amend the above (see below), as the trend is sometimes better than the average to look at - but this depends on your requirement 

// CPU usage trends over the last day 
// Calculate CPU usage patterns across all computers, chart by percentiles. 
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize percentiles(CounterValue, 50, 90, 99) by bin(TimeGenerated, 1h), Computer