Forum Discussion

Brass Contributor

Oct 08, 2020

Solved

Help understanding Processor counters

Hi all I'm trying to create a good query for Log Analytics to measure CPU average usage and peaks in order to determine whether the VM is under/over utilized. For a long time I've been using this...

azure monitor

Query Language

Stanislav_Zhelyazkov
Oct 12, 2020
HiDante Nahuel Ciai

The right query will be:

Perf | where CounterName =~ '% Processor Time' and ObjectName =~ 'Processor' and InstanceName =~ '_Total' | summarize AggregatedValue = avg(CounterValue) by _ResourceId

or if you have on-premises VMs

Perf | where CounterName =~ '% Processor Time' and ObjectName =~ 'Processor' and InstanceName =~ '_Total' | summarize AggregatedValue = avg(CounterValue) by Computer

Basically you only need _Total values for the counter. Besides average you can also use percentile() . I am not sure how max() will work for you as you can have a VM that once had for a second CPU at 100% and then all the time it was as low as 1%. Overall it depends on your logic and what kind of analysis you want to do.

Stanislav_Zhelyazkov

MVP

Oct 12, 2020

HiDante Nahuel Ciai

The right query will be:

Perf
| where CounterName =~ '% Processor Time' and ObjectName =~ 'Processor' and InstanceName =~ '_Total' 
| summarize AggregatedValue = avg(CounterValue) by _ResourceId

or if you have on-premises VMs

Perf
| where CounterName =~ '% Processor Time' and ObjectName =~ 'Processor' and InstanceName =~ '_Total' 
| summarize AggregatedValue = avg(CounterValue) by Computer

Basically you only need _Total values for the counter. Besides average you can also use percentile() . I am not sure how max() will work for you as you can have a VM that once had for a second CPU at 100% and then all the time it was as low as 1%. Overall it depends on your logic and what kind of analysis you want to do.

Dante Nahuel Ciai

Brass Contributor

Oct 12, 2020

Stanislav_Zhelyazkov Thank you for the answer. I came up with the same during the weekend. I removed the max() and instead went for percentile 95, and then check that value, which, if I understood correctly the counter, means that 95% of the sampled time, the counter value is below that value
So, if I go
Percentiles(CPU,5,50,95) and I get
0.5,20,100

it means that 5% of the time, the cpu is below 0.5%, 50% is below 20% and 95% is below 100%
is that correct?

Also, I could use bin to use max(), correct?