KQL Queries , InstanceName values are missing for Windows VM

Question

Hi Team, I am collecting Performance counters such as process, processors from a windows VM but when i querying , under the InstanceName column, all i can see is _Total,Mellanox ConnectX-5 Virtual Adapter _4 ,Microsoft Hyper-V Network Adapter . I am trying to run a query to fetch process ID and their CPU consumption. Can you please guide.

Thanks

Answer 1

Hi Kandamuthu, Sandeep,

Welcome to Microsoft Q&A Forum, thank you for posting your query here!

To find the average CPU Utilization of Azure Virtual Machines, use the below query.

Perf
| where (ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total")
    or (ObjectName == "Memory" and CounterName == "Available MBytes")
| summarize avg(CounterValue) by TimeGenerated, ObjectName, CounterName, InstanceName
| project TimeGenerated, ObjectName, CounterName, InstanceName, CounterValue = avg_CounterValue

if that won't work, try this query,

Perf
| where ObjectName == "Processor"
| project TimeGenerated, InstanceName, CounterValue
| summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1m), InstanceName
| project TimeGenerated, ProcessID = InstanceName, AvgCPU

It would be helpful for you if you can refer to the below example queries.

https://techcommunity.microsoft.com/discussions/azureobservability/creat-a-query-to-get-cpu-usage-from-every-process-on-the-vm/3262559

Hope this helps!

Please reply if you there are any challenges.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Thanks

Answer 2

Hello @Kandamuthu, Sandeep, To fetch the performance counters from an Azure Windows VM, the current implementation by Microsoft Azure is by creating a Data collection rule and add a destination log analytics workspace with performance counter logs.

You can refer provided MS Doc https://docs.azure.cn/en-us/azure-monitor/agents/azure-monitor-agent-data-collection on how to collect data using DCR approach.

By referring to this document https://charbelnemnom.com/get-azure-vm-insights-performance-using-kql/#KQL_Query_CPU_Utilization I have tried below KQL query with InsightsMetrics table to find the CPU consumption of each VM existed.

InsightsMetrics
| where Origin == "vm.azm.ms" and Namespace == "Processor" and Name == "UtilizationPercentage"
| extend cpu=tostring(todynamic(Tags)["vm.azm.ms/totalCpus"])
| summarize CPU_Percentage = avg(Val) by Computer, cpu, _ResourceId
| project Computer, Total_vCPUs=cpu, CPU_Percentage

Alternatively, you can also use below perf KQL query to find the average CPU utilization which is detailed in the below MS DOC examples.
MS Doc: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/queries/perf#memory-and-cpu-usage

Perf
| where TimeGenerated > ago(24h)
| where (CounterName == "% Processor Time" and InstanceName == "_Total")
| project TimeGenerated, CounterName, CounterValue
| summarize avg(CounterValue) by CounterName, bin(TimeGenerated, 1m)

To fetch the Process ID, you need to use the old approach which is retrieving performance counter logs by enabling performance monitor inside the VM after logging into it as shown below. Once it is done, you need to have it defined under windows performance counters under Legacy agents Management of a linked log analytics workspaces.

Then use the below query to fetch the Process ID of processes.

Perf
| where TimeGenerated > ago(24h)
| where ObjectName == "Process" and CounterName == "ID Process" 
| where InstanceName != "Total"

Also, you can check this document https://realworldit.net/archives/610 for more relevant details on queries.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.