Azure Log Analytics: Using Perfmon data

  • Article

Updated: As last night the Settings moved to the Azure portal

Today I was looking at Perfmon data for a particular process.  In this case it happened to be lsass.exe but only on Domain Controllers.

I needed to add this Perfmon Counter to OMS, in Settings - Data - Windows Performance Counters  (via the OMS portal not the Azure portal).  in the Azure portal.

I added the counter called:

Process(*)\% Processor Time

I also set the Sample Interval to 300 seconds rather than the default 10secs...now is a good time for a coffee/tea to allow the data to start to flow.

image

After my coffee break, I dis a  quick check to see if lsass was being captured, in the Advanced Analytics portal I typed:

Perf

| search "lsass"

When the data appeared, I amended the query to just show the info from computers that start with DCnnnn (which is true in my environment, edit to suit), I also filtered on ObjectName and InstanceName to be more precise on where I picked the string lsass up from

Perf
| where TimeGenerated > ago(1d)
| where ObjectName == "Process" and InstanceName == "lsass" and Computer startswith "DC"

image

In the end I wanted to make sure I could see each computer separately on a Line Chart and also restrict the data to One day (always good practise not to pull too much data) and to show in 5minute intervals

Perf

| where TimeGenerated > ago(1d)

| where ObjectName == "Process" and InstanceName == "lsass" and Computer startswith "DC"

| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5min)

| render timechart

image