如何使用 Kusto 日志查询、Azure Monitor 读取/获取虚拟机后台进程

Question

I hope you all are doing great.

I'd like to How to read/get Virtual machine background processes using Kusto Log query on Azure Monitor log analytics process.

eg As shown in below screen shot:

Kindly advise.

Answer 1

Enable the perf counters for the process and you need to get the Process Names out of it by querying the perf table.

You can add the perf counter Process(*)\% Processor Time. By going to Log Analytics instance -> Advanced Settings -> Windows Performance Counters. Then query these performance counters as below.

Perf | where ObjectName == "Process" | where CounterName contains "Processor Time" | summarize makelist(InstanceName) by Computer

And other alternate way is by using the service map feature refer this, you can query ServiceMapProcess_CL table https://learn.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-log-search .

Let me know if this answers.