performance - 如何在 KQL 中使用服务器获取顶级 CPU 的详细信息

Question

我们所有的服务器都安装了 Log Analytics 代理。代理配置为捕获性能计数器信息。通过触发以下查询，我可以轻松地了解所有服务器上的 CPU 使用情况：

Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize HourlyUsage = avg(CounterValue) by bin(TimeGenerated, 1h),  Computer 
| render timechart 

我想创建一个图表，显示前 10 个负载最重的服务器的 CPU 使用率。我创建了一个KQL查询来获取使用服务器的前 10 名 CPU：

let TopCPUMaxServers = Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" 
| summarize Max_CPU = max(CounterValue) by Computer, CounterName
| top 10 by Max_CPU  asc nulls last;

这个查询给了我感兴趣的服务器列表。现在我想得到这个列表的性能计数器。当我尝试这个时：

let TopCPUMaxServers = Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" 
| summarize Max_CPU = max(CounterValue) by Computer, CounterName
| top 10 by Max_CPU  asc nulls last;
Perf | join (TopCPUMaxServers) on Computer 
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer
| render timechart 

我只从时间表上显示的第一个查询中获得测量值。（基本上是 10 个值）如何获取在第一个查询中获得的服务器的性能计数器？

问候，斯文

标签： performanceazure-data-explorerkql

Answer 1

您可以使用 in() 运算符使用下一个变体：

let TopCPUMaxServers = Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" 
| summarize Max_CPU = max(CounterValue) by Computer, CounterName
| top 10 by Max_CPU  asc nulls last
| project Computer;
Perf 
| where Computer in (TopCPUMaxServers)
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer
| render timechart