How I Used Azure Log Analytics to Get a CPU Usage on my Azure Virtual Machines

 

In Azure there are many different ways to check your Virtual Machines CPU, Memory, Disk, Services, VPN status/usage. But in this topic I am going to discuss about CPU usage.

Below are the two ways to check CPU usage of the Virtual Machine.

Option 1 -  To check CPU usage of the Virtual Machine, Select the Virtual Machine -> Overview and Click on the Monitoring Tab.

In Monitoring tab, you can check the last 1 hour, 6-hour, 1 day, 30 days of CPU, Disk, Memory, Network usage. Here you can also check the Virtual Machine Availability and Disk IOPS.

If you want to configure Alerts for CPU usage, then you can do it from here. Click "Enable recommended alert rules" and select the Alert which you want to enable.

In my case I have enabled alert if CPU usage reach 80%, Available Memory Bytes is less than 1GB, Disk IOPS more than 95% and so on.

Option 2 -

In Option 1 you have to configure alerts for each and every Virtual Machine. But if I want to do it on my entire Azure subscription, then there is a very simple way to do it using Azure Log Analytics.

First you need to configure your Log Analytics Workspace, you can specify the how many you want to store Log Analytics data while configuring it and by default it is 30 days.

Once you configure your log Analytics Workspace, then go to Log Analytics Workspace -> Logs

Below is an example query to get the CPU usage of all the virtual machines in a Log Analytics workspace:

Perf

| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName != "_Total"

| summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 5m), Computer

This query will show you the CPU usage for the "Processor" object and "% Processor Time" counter for all virtual machines in your Azure subscription. The 'where' will filters out the "_Total" instance, which represents the total CPU usage across all CPU cores. The summarize operator calculates the average CPU usage over a 5-minute of time period for each virtual machine.

You can modify the log Analytic query to filter by specific Virtual machines or time periods by changing the where statements.

Example

Perf

| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName != "_Total"

| summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 15m), Computer

| where Computer startswith "Azure-WEB" or Computer startswith "Azure-AD"