☰

在 Azure Log Analytics 中查找高 CPU 进程

tag-icon • tag-icon azure
在 Azure Log Analytics 中查找高 CPU 进程

我在 Log Analytics 中创建了以下警报。该警报旨在获取过去十分钟内 _Total CPU 使用率超过 90% 的所有计算机。但是，当我运行警报时，我收到错误：

“join”运算符：无法解析名为“FindCPU”的表或列表达式

有人可以告诉我解决这个问题需要做什么吗？

//Find Top processes utilizing CPU
// by finding the machine(s) using over 90% of CPU
// then finding the processes using the CPU
// also finding CPU count of the machines to find the actual percentage of CPU being used

//defining our CPU threshold
let CPUThreshold = 90;

//define time sample rate
let Time = 10m;

//define Count of processes to return
let Count = 5;

//Find instances of total cpu being used above 90% over the last 10 minutes
let TopCPU = Perf
| where TimeGenerated > now(-Time)
              and ObjectName == "Processor"
              and CounterName == "% Processor Time"
              and InstanceName == "_Total"
              and CounterValue > CPUThreshold
| project Computer, ObjectName
              , CounterName, CounterValue
              , TimeGenerated;
//end query

// find top Processes, excluding _Total and Idle instances, there may be other instances you want to exclude as well
let TopProcess = Perf
| where TimeGenerated > now(-Time)
               and CounterName == "% Processor Time"
               and InstanceName != "_Total"
               and InstanceName != "Idle"
| project Computer, ObjectName
              , CounterName, InstanceName
              , CounterValue, TimeGenerated;
// end query

// find CPU count for servers(s)
let FindCPU = Perf
| where TimeGenerated >= ago(1h)
| where ObjectName == "Processor"
              and CounterName == "% Processor Time"
              and InstanceName!="_Total"
| sort by InstanceName asc nulls first
| summarize CPUCount = dcount(InstanceName) by Computer;
// end query

//Join all 3 datasets together
FindCPU | join(TopCPU) on Computer 
| join(TopProcess)on Computer
| extend PercentProcessorUsed = CounterValue1 / CPUCount
| summarize avg(PercentProcessorUsed) by Computer, ObjectName
                  , CounterName, CPUCount 
                  , TotalCPU=CounterValue //rename CounterValue to TotalCPU 
                  , Process=ObjectName1 //rename ObjectName1 to Process 
                  , ProcessTime=CounterName1 //rename CounterName1 to ProcessTime 
                  , ProcessName=InstanceName //rename InstanceName to ProcessName 
                  , TimeGenerated
| where Process == "Process"
and avg_PercentProcessorUsed > 25 // only return processes that are using more than 25%
| top Count by avg_PercentProcessorUsed desc
| project Computer, CPUCount
                , ProcessName , avg_PercentProcessorUsed
                , TotalCPU, Process
                , ProcessTime, TimeGenerated

谢谢

答案1

查询运行良好（尽管对于您要做的事情来说似乎有点过于复杂），但是，您需要确保在运行时选择了所有查询。

默认情况下，如果您的光标位于所有查询的末尾，Log Analytics 将仅运行最后一个查询，这显然会出错，因为它找不到“FindCPU”。突出显示所有内容，然后运行它，它就可以正常工作。

相关内容