Encontre processos de alta CPU no Azure Log Analytics

Question

Criei o seguinte alerta no Log Analytics. O alerta foi projetado para obter todos os computadores onde o uso _Total da CPU foi superior a 90% nos últimos dez minutos. No entanto, quando executo o alerta, recebo o erro:

Operador 'join': Falha ao resolver a expressão de tabela ou coluna chamada 'FindCPU'

Alguém pode me informar o que pode ser necessário para corrigir esse problema?

//Find Top processes utilizing CPU
// by finding the machine(s) using over 90% of CPU
// then finding the processes using the CPU
// also finding CPU count of the machines to find the actual percentage of CPU being used

//defining our CPU threshold
let CPUThreshold = 90;

//define time sample rate
let Time = 10m;

//define Count of processes to return
let Count = 5;

//Find instances of total cpu being used above 90% over the last 10 minutes
let TopCPU = Perf
| where TimeGenerated > now(-Time)
              and ObjectName == "Processor"
              and CounterName == "% Processor Time"
              and InstanceName == "_Total"
              and CounterValue > CPUThreshold
| project Computer, ObjectName
              , CounterName, CounterValue
              , TimeGenerated;
//end query

// find top Processes, excluding _Total and Idle instances, there may be other instances you want to exclude as well
let TopProcess = Perf
| where TimeGenerated > now(-Time)
               and CounterName == "% Processor Time"
               and InstanceName != "_Total"
               and InstanceName != "Idle"
| project Computer, ObjectName
              , CounterName, InstanceName
              , CounterValue, TimeGenerated;
// end query

// find CPU count for servers(s)
let FindCPU = Perf
| where TimeGenerated >= ago(1h)
| where ObjectName == "Processor"
              and CounterName == "% Processor Time"
              and InstanceName!="_Total"
| sort by InstanceName asc nulls first
| summarize CPUCount = dcount(InstanceName) by Computer;
// end query

//Join all 3 datasets together
FindCPU | join(TopCPU) on Computer 
| join(TopProcess)on Computer
| extend PercentProcessorUsed = CounterValue1 / CPUCount
| summarize avg(PercentProcessorUsed) by Computer, ObjectName
                  , CounterName, CPUCount 
                  , TotalCPU=CounterValue //rename CounterValue to TotalCPU 
                  , Process=ObjectName1 //rename ObjectName1 to Process 
                  , ProcessTime=CounterName1 //rename CounterName1 to ProcessTime 
                  , ProcessName=InstanceName //rename InstanceName to ProcessName 
                  , TimeGenerated
| where Process == "Process"
and avg_PercentProcessorUsed > 25 // only return processes that are using more than 25%
| top Count by avg_PercentProcessorUsed desc
| project Computer, CPUCount
                , ProcessName , avg_PercentProcessorUsed
                , TotalCPU, Process
                , ProcessTime, TimeGenerated

Obrigado

Answer 1

A consulta funciona bem (embora pareça um pouco complicada para o que você está tentando fazer), no entanto, você precisa ter certeza de selecionar todas as consultas ao executá-la.

Por padrão, se o seu cursor estiver no final de todas as consultas, o Log Analytics executará apenas a última consulta, o que obviamente dá erro porque não consegue encontrar "FindCPU". Destaque tudo, execute-o e funciona bem.