{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cf72b08b-e727-4a5e-b78f-84940a9726a3", "version": "KqlParameterItem/1.0", "name": "Subscriptions", "type": 6, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "includeAll": true }, "timeContext": { "durationMs": 86400000 }, "defaultValue": "", "value": [] }, { "id": "ce1d8e43-28b6-4fd4-8ebb-ad04a68d504f", "version": "KqlParameterItem/1.0", "name": "WorkSpaces", "type": 5, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id", "crossComponentResources": [ "{Subscriptions}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "label": "Log Analytics Workspaces", "defaultValue": "", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [] }, { "id": "9206327d-6ffa-4dc8-ae3e-a2e6ec59f4c6", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "label": "Time range", "value": { "durationMs": 14400000 } }, { "id": "9b253dd6-24fa-4c72-bc24-0018d2e12ad2", "version": "KqlParameterItem/1.0", "name": "resource", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "Resources | where type =~ 'microsoft.azurestackhci/clusters'", "crossComponentResources": [ "value::all" ], "typeSettings": { "showDefault": false, "additionalResourceOptions": [ "value::all" ] }, "timeContext": { "durationMs": 0 }, "label": "Azure Local Cluster", "defaultValue": "value::all", "allowCustom": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "39d73fd2-3199-4146-a053-3357e4ff11db", "version": "KqlParameterItem/1.0", "name": "servers", "label": "Nodes", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Event\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\" \r\n| where TimeGenerated {TimeRange:query}\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\r\n| extend servers_information = parse_json(RenderedDescription).m_servers\r\n| mv-expand servers_information\r\n| extend Nodename = tostring(servers_information.m_name)\r\n| sort by Nodename asc\r\n| project Nodename", "crossComponentResources": [ "{WorkSpaces}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "f0ad1bbb-e939-4e63-9327-56e7aaf86ab8", "version": "KqlParameterItem/1.0", "name": "lastCorrelationId", "type": 2, "query": "Event\r\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\r\n| where TimeGenerated {TimeRange:query}\r\n| extend ClusterArmId = '{resource}'\r\n| extend description = parse_json(RenderedDescription)\r\n| where description.ArmId =~ ClusterArmId\r\n| where description.IsLastMessage =~ 'true'\r\n| extend CorrelationId = tostring(description.CorrelationId)\r\n| summarize arg_max(TimeGenerated, CorrelationId) by ClusterArmId\r\n| project lastCorrelationId = CorrelationId", "crossComponentResources": [ "{WorkSpaces}" ], "isHiddenWhenLocked": true, "typeSettings": { "additionalResourceOptions": [ "value::1" ] }, "timeContext": { "durationMs": 14400000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::1", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "62ac704f-082f-4b32-97d6-13a956339e05", "version": "KqlParameterItem/1.0", "name": "isHealthy", "type": 1, "query": "Event\r\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\r\n| where TimeGenerated {TimeRange:query}\r\n| extend ClusterArmId = '{resource}'\r\n| extend description = parse_json(RenderedDescription)\r\n| where description.ArmId =~ ClusterArmId\r\n| where description.IsLastMessage =~ 'true'\r\n| where description.CorrelationId =~ '{lastCorrelationId}'\r\n| extend CorrelationId = tostring(description.CorrelationId)\r\n| project isHealthy = tostring(description.Fault == \"{}\")", "crossComponentResources": [ "{WorkSpaces}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 14400000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::1", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Parameters" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "c8ab3b2e-8091-44f7-9381-ab30f2a23f12", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "TAB_OVERVIEW", "preText": "Overview", "style": "link" }, { "id": "40cdd024-599c-4561-93aa-6c090a8477c6", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "VM State", "subTarget": "TAB_VMSTATE", "style": "link" }, { "id": "b9a01e58-c08b-4761-8370-310b070e1944", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "CPU", "subTarget": "TAB_CPU", "style": "link" }, { "id": "7ca3749d-3cda-4937-b74c-c18c0b0893ef", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "Storage", "subTarget": "TAB_STORAGE", "style": "link" }, { "id": "acdc95dc-2915-47af-9c1c-e0c499dd3096", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "Network", "subTarget": "TAB_NETWORK", "style": "link" }, { "id": "ae20ace3-4f28-4801-98bd-0866d94f1d81", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "RAM", "subTarget": "TAB_RAM", "style": "link" } ] }, "name": "Navigation" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Health Status", "expandable": true, "expanded": true, "items": [ { "type": 1, "content": { "json": "## Health Status" }, "name": "text - 2" }, { "type": 1, "content": { "json": "There is no health fault on this cluster." }, "conditionalVisibility": { "parameterName": "isHealthy", "comparison": "isEqualTo", "value": "True" }, "name": "no alert text" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "View health faults on the cluster, select the fault to see the details and remediation actions. The reported time is the time the fault first occurred.\r\n" }, "name": "health text" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Event\r\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\r\n| extend description = parse_json(RenderedDescription)\r\n| extend CorrelationId = tostring(description.CorrelationId)\r\n| where CorrelationId =~ '{lastCorrelationId}'\r\n| where tostring(description.Fault.RootObjectType) == 'Microsoft.Health.EntityType.Cluster'\r\n| extend Severity = toint(description.Fault.Severity)\r\n| summarize Total = count(), Warning = countif(Severity == 1), Critical = countif(Severity == 2), Other = countif(Severity == 255)\r\n| evaluate narrow()\r\n| extend Column = iff(Column == \"Total\", \"Total faults\", Column)", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Column", "formatter": 1 }, "leftContent": { "columnMatch": "Value", "formatter": 12, "formatOptions": { "palette": "none" } }, "rightContent": { "columnMatch": "Column", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Total faluts", "text": "" }, { "operator": "==", "thresholdValue": "Critical", "representation": "4", "text": "" }, { "operator": "==", "thresholdValue": "Warning", "representation": "2", "text": "" }, { "operator": "==", "thresholdValue": "Other", "representation": "unknown", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "" } ] } }, "showBorder": false, "size": "auto" } }, "name": "health query" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Event\r\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\r\n| extend description = parse_json(RenderedDescription)\r\n| extend CorrelationId = tostring(description.CorrelationId)\r\n| where CorrelationId =~ '{lastCorrelationId}'\r\n| where tostring(description.Fault.RootObjectType) == 'Microsoft.Health.EntityType.Cluster'\r\n| extend Fault = description.Fault\r\n| extend ShortDescription = split(tostring(Fault.Type), '.')[-1]\r\n| extend Severity = toint(Fault.Severity)\r\n| extend FaultingResourceType = split(tostring(Fault.ObjectType), '.')[-1]\r\n| extend FaultingResourceId = tostring(Fault.ObjectId)\r\n| extend ReportedTime = datetime_add('Microsecond', tolong(Fault.Timestamp)/10, make_datetime(1601,1,1))\r\n| extend Detail = pack(\r\n\"Severity\", iff(Severity == 0, \"Healthy\", iff(Severity == 1, \"Warning\", iff(Severity == 2, \"Critical\", \"Unknown\"))),\r\n\"Faulting Resource ID\", FaultingResourceId,\r\n\"Faulting Resource Type\", FaultingResourceType,\r\n\"Reported Time\", ReportedTime,\r\n\"Short Description\", ShortDescription,\r\n\"Description\", tostring(Fault.Description),\r\n\"Remediation\", tostring(Fault.Remediation))\r\n| sort by ReportedTime asc\r\n| project ShortDescription, Detail, FaultingResourceType, FaultingResourceId, Severity, ReportedTime", "size": 3, "showAnalytics": true, "noDataMessage": "There are no health faults on this cluster.", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ShortDescription", "formatter": 1, "formatOptions": { "linkColumn": "Detail", "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "Detail", "formatter": 5, "formatOptions": { "linkColumn": "Detail", "linkTarget": "CellDetails", "linkLabel": "Open", "linkIsContextBlade": true } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "success", "text": "Healthy" }, { "operator": "==", "thresholdValue": "1", "representation": "2", "text": "Warning" }, { "operator": "==", "thresholdValue": "2", "representation": "4", "text": "Critical" }, { "operator": "Default", "thresholdValue": null, "representation": "unknown", "text": "Unknown" } ] } } ], "filter": true, "labelSettings": [ { "columnId": "ShortDescription", "label": "Fault", "comment": "" }, { "columnId": "FaultingResourceType", "label": "Faulting resource type" }, { "columnId": "FaultingResourceId", "label": "Faulting resource ID" }, { "columnId": "ReportedTime", "label": "Initial fault time" } ] } }, "name": "health detail query" } ] }, "conditionalVisibility": { "parameterName": "isHealthy", "comparison": "isEqualTo", "value": "False" }, "name": "alerts group" } ] }, "conditionalVisibility": { "parameterName": "isHealthy", "comparison": "isNotEqualTo" }, "name": "Health" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Intro", "expandable": true, "expanded": true, "items": [ { "type": 1, "content": { "json": "## Version 1.0.0\r\n\r\n![Version 1.0.0](https://schmitt-nieto.com/assets/img/post/2025-10-31-azure-local-deep-insights/Version.1.0.0.png)\r\n\r\nIf update is needed, please redeploy\r\n\r\n[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fschmitt-nieto.com%2Fassets%2Fimg%2Fpost%2F2025-10-31-azure-local-deep-insights%2FAzureLocalDeepInsights.json)\r\n" }, "customWidth": "15", "name": "Current Version" }, { "type": 1, "content": { "json": "# Azure Local Deep Insights Workbook\r\n\r\nI built this after not finding a single Azure Local workbook that met my day to day needs. It starts from the default Azure Local Insights workbook and extends it with a deeper view of VMs, including CPU, RAM, and network, all in one place. It works across multiple subscriptions and workspaces.\r\n\r\nA complete build and setup guide is on my blog: [https://schmitt-nieto.com/azure-local-workbook](https://schmitt-nieto.com/azure-local-workbook)\r\n\r\n## What you get\r\n\r\n* **Azure Local VM state**: the latest state for each VM, plus an expandable history of state changes.\r\n* **Azure Local CPU**: top VMs by guest CPU, per vCPU drill down for a selected VM, host CPU load, and virtual processor totals.\r\n* **Azure Local Storage**: cluster level latency, IOPS, and throughput.\r\n* **Azure Local Network**: throughput and traffic sent, from cluster and VMs.\r\n* **Azure Local RAM**: memory usage in Cluster and VMs.\r\n\r\n## Roadmap\r\n\r\n* Add **AKS** views.\r\n* Add **AVD** views. There are already strong AVD workbooks, but I will include an opinionated view here for convenience.\r\n\r\n## Notes and limits\r\n\r\nRight now I have not found a non disruptive way to measure VM storage from inside the guests without side effects. Because of that, storage is reported at the cluster level only for now.\r\n\r\n## Global parameters\r\n\r\n* **Subscriptions**: one or more Azure subscriptions to scope the queries.\r\n* **LogAnalyticsWorkspace**: one or more workspaces that hold your Azure Local logs and performance data.\r\n* **Time range**: choose how many hours of data to query.\r\n* **Azure Local Cluster**: optionally filter to a single cluster. Default is all.\r\n* **Node**: optionally filter to a single cluster node. Default is all.\r\n\r\n## Required data collection (DCR)\r\n\r\nAdd these to your Data Collection Rules so the visuals have the signals they need. I use a Sample rate from 60 seconds, but you can use more or less depending on your needs. \r\n\r\n### Event logs (XPaths)\r\n\r\n**VM state required logs**\r\n\r\n`Microsoft-Windows-Hyper-V-Worker-Admin![System[(EventID=18500 or EventID=18502 or EventID=18504 or EventID=18510 or EventID=18512 or EventID=18514 or EventID=18516 or EventID=18518 or EventID=18596 or EventID=18601)]]`\r\n\r\n`Microsoft-Windows-Hyper-V-VMMS-Admin![System[(EventID=13002 or EventID=13003)]]`\r\n\r\n### Performance counters\r\n\r\n**VM CPU**\r\n\r\n`\\Hyper-V Hypervisor Virtual Processor()% Guest Run Time`\r\n\r\n`\\Hyper-V Hypervisor Virtual Processor()% Total Run Time`\r\n\r\n`\\Hyper-V Hypervisor Virtual Processor(*)% Hypervisor Run Time`\r\n\r\n`\\Hyper-V Hypervisor Logical Processor(_Total)% Total Run Time`\r\n\r\n**VM Network throughput**\r\n\r\n`\\Hyper-V Virtual Network Adapter(*)\\Bytes Received/sec`\r\n\r\n`\\Hyper-V Virtual Network Adapter(*)\\Bytes Sent/sec`\r\n\r\n`\\Hyper-V Virtual Switch(*)\\Bytes Received/sec`\r\n\r\n`\\Hyper-V Virtual Switch(*)\\Bytes Sent/sec`\r\n\r\n**VM RAM**\r\n\r\n`\\Hyper-V Dynamic Memory VM(*)\\Guest Available Memory` \r\n\r\n`\\Hyper-V Dynamic Memory VM(*)\\Guest Visible Physical Memory`\r\n" }, "name": "Intro" } ] }, "name": "Intro" } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "TAB_OVERVIEW" }, "name": "Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Azure Local VM State and Events\nFast view of VM state across clusters and nodes, plus the latest status per VM such as running or paused. Use All VM state events to browse the full history grouped by state then VM, including entries for VMs that were deleted." }, "name": "Intro" }, { "type": 1, "content": { "json": "## Cluster VMs Running" }, "name": "text - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet s = iff(isnull(_start), ago(30d), _start);\r\nlet e = iff(isnull(_end), now(), _end);\r\n\r\nEvent\r\n| where TimeGenerated between (s .. e)\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3003\"\r\n| extend ClusterName = tostring(parse_xml(EventData).DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(parse_xml(EventData).DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId in~ ('{resource}')\r\n| summarize arg_max(TimeGenerated, *) by ClusterName\r\n| extend description = parse_json(RenderedDescription)\r\n| extend VmsUnknown = tolong(coalesce(description.m_totalVmsUnknown, 0))\r\n| extend VmsRunning = tolong(coalesce(description.m_totalVmsRunning, 0))\r\n| extend VmsStopped = tolong(coalesce(description.m_totalVmsStopped, 0))\r\n| extend VmsFailed = tolong(coalesce(description.m_totalVmsFailed, 0))\r\n| extend VmsPaused = tolong(coalesce(description.m_totalVmsPaused, 0))\r\n| extend VmsSuspended = tolong(coalesce(description.m_totalVmsSuspended, 0))\r\n| extend VmsStarting = tolong(coalesce(description.m_totalVmsStarting, 0))\r\n| extend VmsSnapshotting = tolong(coalesce(description.m_totalVmsSnapshotting, 0))\r\n| extend VmsSaving = tolong(coalesce(description.m_totalVmsSaving, 0))\r\n| extend VmsStopping = tolong(coalesce(description.m_totalVmsStopping, 0))\r\n| extend VmsPausing = tolong(coalesce(description.m_totalVmsPausing, 0))\r\n| extend VmsResuming = tolong(coalesce(description.m_totalVmsResuming, 0))\r\n| project\r\n VmsRunning,\r\n VmsStopped,\r\n VmsFailed,\r\n VmsOther = VmsUnknown + VmsStarting + VmsSnapshotting + VmsSaving + VmsStopping + VmsPausing + VmsResuming + VmsPaused + VmsSuspended\r\n| evaluate narrow()\r\n| project Column, tolong(Value)\r\n", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "VmsRunning", "color": "green" }, { "seriesName": "VmsStopped", "color": "gray" }, { "seriesName": "VmsFailed", "color": "redBright" }, { "seriesName": "VmsOther", "color": "yellow" } ] } }, "name": "Virtual Machine Chart" }, { "type": 1, "content": { "json": "## Node VMs Running" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Event\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\"\n| extend ClusterName = tostring(parse_xml(EventData).DataItem.UserData.EventData[\"ClusterName\"])\n| extend ClusterArmId = tostring(parse_xml(EventData).DataItem.UserData.EventData[\"ArmId\"])\n| where ClusterArmId =~ '{resource}'\n| extend ServerResourceId = strcat_array(array_slice(split(_ResourceId,\"/\"), 0, -2), \"/\")\n| extend servers_information = parse_json(RenderedDescription).m_servers\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\n| mv-expand servers_information\n| extend VmsFailed = toint(servers_information.m_vm.m_totalVmsFailed)\n| extend VmsRunning = toint(servers_information.m_vm.m_totalVmsRunning)\n| extend VmsStopped = toint(servers_information.m_vm.m_totalVmsStopped)\n| extend VmsOther = toint(toint(servers_information.m_vm.m_totalVmsPaused) + toint(servers_information.m_vm.m_totalVmsPausing) + toint(servers_information.m_vm.m_totalVmsResuming) + toint(servers_information.m_vm.m_totalVmsSaving) + toint(servers_information.m_vm.m_totalVmsSnapshotting) + toint(servers_information.m_vm.m_totalVmsStarting) + toint(servers_information.m_vm.m_totalVmsStopping) + toint(servers_information.m_vm.m_totalVmsSuspended) + toint(servers_information.m_vm.m_totalVmsUnknown))\n| extend Nodename = tostring(servers_information.m_name)\n| extend Hostname = strcat(ServerResourceId, \"/\", Nodename)\n| order by tolower(Nodename) asc\n| project Hostname, Nodename, LastUpdated = TimeGenerated, VmsTotal = VmsFailed + VmsRunning + VmsStopped + VmsOther, VmsRunning, VmsStopped, VmsFailed, VmsOther", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "exportToExcelOptions": "all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Hostname", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "subTarget": "insights", "showIcon": true, "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "templateIdSource": "static", "templateId": "Community-Workbooks/Azure Stack HCI/Server", "typeSource": "workbook", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "server", "source": "column", "value": "Nodename" } ] } } }, { "columnMatch": "Nodename", "formatter": 5 }, { "columnMatch": "LastUpdated", "formatter": 6, "dateFormat": { "showUtcTime": null, "formatName": "shortDateTimePattern" } }, { "columnMatch": "VmsTotal", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"VmsRunning\"] of [\"VmsTotal\"] running", "columnSettings": [ { "columnName": "VmsRunning", "color": "green" }, { "columnName": "VmsFailed", "color": "red" }, { "columnName": "VmsStopped", "color": "orange" }, { "columnName": "VmsOther", "color": "gray" } ], "noRowsScaling": true } } } ], "filter": true } }, "name": "Virtual Machines Grid View" }, { "type": 1, "content": { "json": "## Latest state per VM" }, "name": "Header 1" }, { "type": 1, "content": { "json": "VMs will only be displayed after a successful operation, such as a reboot, creation, or moving the VM to another node in the cluster. If a VM is running but no changes are being registered (since the configuration from Data Collection Rule ), it will not appear. I am currently working on an alternative solution that relies on metrics already being collected for running VMs, such as RAM, CPU, or network usage. Once I implement this functionality, I will remove this disclaimer.\r\n", "style": "warning" }, "name": "VM Disclaimer" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 36500d;\n\n// Latest Worker/Admin state per VM\nlet Worker =\n Event\n | where TimeGenerated > ago(lookback)\n | where EventLog in (\"Microsoft-Windows-Hyper-V-Worker-Admin\", \"Microsoft-Windows-Hyper-V-Worker/Admin\")\n | where EventID in (18500,18502,18504,18510,18512,18514,18516,18518,18596,18601)\n | extend xml = parse_xml(EventData)\n | extend VMx = tostring(xml.Event.UserData.VmlEventLog.VmName['#text'])\n | extend VM = coalesce(VMx, extract(\"'([^']+)'\", 1, RenderedDescription))\n | where isnotempty(VM)\n | extend VMState = case(\n EventID in (18500,18518,18596,18601), \"Running\",\n EventID in (18502,18504), \"Off\",\n EventID == 18510, \"Saved\",\n EventID == 18516, \"Paused\",\n EventID in (18512,18514), \"Reset\",\n \"Other\")\n | summarize arg_max(TimeGenerated, VMState, EventID, Computer) by VM\n | project VM, EventState=VMState, EventTime=TimeGenerated, EventID, Host=Computer;\n\n// Latest VMMS lifecycle event (create/delete)\nlet VMMSLast =\n Event\n | where TimeGenerated > ago(lookback)\n | where EventLog in (\"Microsoft-Windows-Hyper-V-VMMS-Admin\", \"Microsoft-Windows-Hyper-V-VMMS/Admin\")\n | where EventID in (13002,13003)\n | extend xml = parse_xml(EventData)\n | extend VMx = tostring(xml.Event.UserData.VmlEventLog.VmName['#text'])\n | extend VM = coalesce(VMx, extract(\"'([^']+)'\", 1, RenderedDescription))\n | where isnotempty(VM)\n | summarize arg_max(TimeGenerated, EventID) by VM\n | project VM, LastVMMSId=EventID, LastVMMSTime=TimeGenerated;\n\nWorker\n| join kind=fullouter VMMSLast on VM\n| where isnull(LastVMMSId) or LastVMMSId != 13003\n| extend CurrentState = coalesce(EventState, iif(LastVMMSId == 13002, \"Unknown\", \"Unknown\"))\n| extend RunningState = iif(CurrentState == \"Running\", \"Running\", \"Not Running\")\n| project VM, RunningState, CurrentState, Host, EventTime, EventID\n| order by VM asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "startsWith", "thresholdValue": "Running", "representation": "success", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Not Running", "representation": "stopped", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Saved", "representation": "Save" }, { "operator": "startsWith", "thresholdValue": "Reset", "representation": "pending" }, { "operator": "startsWith", "thresholdValue": "Paused", "representation": "Paused", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Off", "representation": "stopped", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Other", "representation": "unknown", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "RunningState", "formatter": 5 }, { "columnMatch": "CurrentState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "startsWith", "thresholdValue": "Running", "representation": "success", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Pause", "representation": "Paused" }, { "operator": "startsWith", "thresholdValue": "Save", "representation": "Save" }, { "operator": "startsWith", "thresholdValue": "Off", "representation": "stopped" }, { "operator": "startsWith", "thresholdValue": "Reset", "representation": "pending" }, { "operator": "Default", "thresholdValue": null, "representation": "unknown", "text": "{0}{1}" } ] } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "CurrentState" ], "expandTopLevel": true }, "sortBy": [ { "itemKey": "$gen_thresholds_CurrentState_3", "sortOrder": 1 } ], "labelSettings": [ { "columnId": "RunningState", "label": "State" }, { "columnId": "CurrentState", "label": "Last State" }, { "columnId": "EventTime", "label": "Last Event" } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_CurrentState_3", "sortOrder": 1 } ] }, "name": "Latest state per VM", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "## All VM state events (grouped by state and then VM)" }, "name": "Header 2" }, { "type": 1, "content": { "json": "VMs will only be displayed after a successful operation, such as a reboot, creation, or moving the VM to another node in the cluster. If a VM is running but no changes are being registered (since the configuration from Data Collection Rule ), it will not appear. I am currently working on an alternative solution that relies on metrics already being collected for running VMs, such as RAM, CPU, or network usage. Once I implement this functionality, I will remove this disclaimer.\r\n", "style": "warning" }, "name": "All VM Disclaimer" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = 36500d;\n\n// Worker/Admin runtime states\nlet WorkerEv =\n Event\n | where TimeGenerated > ago(lookback)\n | where EventLog in (\"Microsoft-Windows-Hyper-V-Worker-Admin\", \"Microsoft-Windows-Hyper-V-Worker/Admin\")\n | where EventID in (18500,18502,18504,18510,18512,18514,18516,18518,18596,18601)\n | extend _ed = tostring(column_ifexists(\"EventData\",\"\"))\n | extend _rd = tostring(column_ifexists(\"RenderedDescription\",\"\"))\n | extend xml = parse_xml(_ed)\n | extend VM_from_xml = tostring(coalesce(xml.Event.UserData.VmlEventLog.VmName['#text'], xml.Event.UserData.VmlEventLog.VmName))\n | extend VM = coalesce(VM_from_xml,\n extract(\"'([^']+)'\", 1, _rd),\n extract(@\"(?i)virtual machine '([^']+)'\", 1, _rd))\n | where isnotempty(VM)\n | extend VMStateEvent = case(\n EventID in (18500,18518,18596,18601), \"Running\",\n EventID in (18502,18504), \"Off\",\n EventID == 18510, \"Saved\",\n EventID == 18516, \"Paused\",\n EventID in (18512,18514), \"Reset\",\n \"Other\")\n | project VM, TimeGenerated, VMStateEvent, EventID, Computer, RenderedDescription=_rd, Source=\"Worker\";\n\n// VMMS lifecycle (Deleted surfaced as a state; Created kept if you decide to include it)\nlet VMMSEv =\n Event\n | where TimeGenerated > ago(lookback)\n | where EventLog in (\"Microsoft-Windows-Hyper-V-VMMS-Admin\", \"Microsoft-Windows-Hyper-V-VMMS/Admin\")\n | where EventID in (13002,13003) // 13002=Created, 13003=Deleted\n | extend _ed = tostring(column_ifexists(\"EventData\",\"\"))\n | extend _rd = tostring(column_ifexists(\"RenderedDescription\",\"\"))\n | extend xml = parse_xml(_ed)\n | extend VM_from_xml = tostring(coalesce(xml.Event.UserData.VmlEventLog.VmName['#text'], xml.Event.UserData.VmlEventLog.VmName))\n | extend VM = coalesce(VM_from_xml,\n extract(\"'([^']+)'\", 1, _rd),\n extract(@\"(?i)virtual machine '([^']+)'\", 1, _rd))\n | where isnotempty(VM)\n | extend VMStateEvent = case(EventID == 13003, \"Deleted\",\n EventID == 13002, \"Created\", \"Other\")\n | project VM, TimeGenerated, VMStateEvent, EventID, Computer, RenderedDescription=_rd, Source=\"VMMS\";\n\n// Latest state per VM (label used for grouping)\nlet LastState =\n union WorkerEv, VMMSEv\n | where VMStateEvent in (\"Running\",\"Off\",\"Saved\",\"Paused\",\"Reset\",\"Deleted\")\n | summarize arg_max(TimeGenerated, VMStateEvent) by VM\n | project VM, LatestState = VMStateEvent\n | extend LatestStateOrder = case(\n LatestState == \"Running\", 1,\n LatestState == \"Off\", 2,\n LatestState == \"Saved\", 3,\n LatestState == \"Paused\", 4,\n LatestState == \"Reset\", 5,\n LatestState == \"Deleted\", 6,\n 99);\n\n// All events, grouped by Current state > VM (history preserved)\nunion WorkerEv, VMMSEv\n| where VMStateEvent in (\"Running\",\"Off\",\"Saved\",\"Paused\",\"Reset\",\"Deleted\")\n| join kind=inner LastState on VM\n| order by LatestStateOrder asc, VM asc, TimeGenerated desc\n| project\n VMState = VMStateEvent, // per-event state you want to see\n TimeGenerated,\n EventID,\n Computer,\n RenderedDescription,\n Source,\n VM,\n VMStateGroup = LatestState // used only for grouping\n\n", "size": 2, "showAnalytics": true, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "startsWith", "thresholdValue": "Running", "representation": "success", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Off", "representation": "stopped", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Deleted", "representation": "Delete", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Created", "representation": "Release", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Saved", "representation": "Save", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Paused", "representation": "Paused", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Reset", "representation": "pending", "text": "{0}{1}" }, { "operator": "startsWith", "thresholdValue": "Other", "representation": "unknown", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ], "customColumnWidthSetting": "85ch" } }, { "columnMatch": "VMState", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "TimeGenerated", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "27ch" } }, { "columnMatch": "EventID", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "13ch" } }, { "columnMatch": "Computer", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } }, { "columnMatch": "RenderedDescription", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "90ch" } }, { "columnMatch": "Source", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "12ch" } }, { "columnMatch": "VM", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "VMStateGroup", "VM" ], "expandTopLevel": false } } }, "name": "All VM state events (grouped)", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "TAB_VMSTATE" }, "name": "VMState" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Azure Local CPU\n\nQuick view of CPU across your environment: top VMs by guest CPU, a drill down to vCPU cores for any selected VM, and host level usage with virtual processor totals, Hyper V logical CPU, and physical CPU per node.\n" }, "name": "Intro" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Health = Event\r\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\r\n| extend description = parse_json(RenderedDescription)\r\n| extend CorrelationId = tostring(description.CorrelationId)\r\n| where CorrelationId =~ '{lastCorrelationId}'\r\n| where tostring(description.Fault.ObjectType) == 'Microsoft.Health.EntityType.Server'\r\n| extend NodeId = tolower(tostring(description.Fault.ObjectId))\r\n| extend Severity = toint(description.Fault.Severity)\r\n| extend Severity = iff(Severity > 2, -1, Severity)\r\n| summarize Status = max(Severity) by NodeId;\r\n\r\nEvent\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\"\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\r\n| extend ArmPrefix = extract(@'(.+/)[^/]+$', 1, _ResourceId)\r\n| extend servers_information = parse_json(RenderedDescription).m_servers\r\n| mv-expand servers_information\r\n| extend Nodename = tostring(servers_information.m_name)\r\n| extend NodeId = tolower(Nodename)\r\n| join kind=leftouter Health on NodeId\r\n| extend serverArmId = strcat(ArmPrefix, Nodename)\r\n| extend UsedCpu = toint(servers_information.m_totalProcessorsUsedPercentage)\r\n| extend AvailableCpu = 100 - UsedCpu\r\n| extend TotalMemory = todecimal(servers_information.m_totalPhysicalMemoryInBytes)\r\n| extend UsedMemory = iff(TotalMemory == 0.0, todecimal(0.0), todecimal(servers_information.m_usedPhysicalMemoryInBytes))\r\n| extend AvailableMemory = iff(TotalMemory == 0.0, todecimal(1.0), todecimal(TotalMemory - UsedMemory))\r\n| extend MemoryUsage = iff(TotalMemory == 0.0, todecimal(0.0), todecimal(round(UsedMemory/TotalMemory*100, 0)))\r\n| extend LogicalProcessors = toint(servers_information.m_totalLogicalProcessors)\r\n| extend PhysicalProcessors = toint(servers_information.m_totalPhysicalProcessors)\r\n| extend Site = tostring(servers_information.m_site)\r\n| extend Uptime = tolong(servers_information.m_uptimeInSeconds)\r\n| extend DomainGroup = extract(@'[^\\.]+\\.(.+)', 1, Computer)\r\n| order by tolower(Nodename) asc\r\n| project serverArmId, Nodename, LastUpdated = TimeGenerated, Status, UsedCpu, AvailableCpu, MemoryUsage, UsedMemory, AvailableMemory, LogicalProcessors, PhysicalProcessors, Uptime, Site, DomainGroup", "size": 3, "showAnalytics": true, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "serverArmId", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "subTarget": "insights", "showIcon": true } }, { "columnMatch": "Nodename", "formatter": 5 }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "2", "text": "Warning" }, { "operator": "==", "thresholdValue": "2", "representation": "4", "text": "Critical" }, { "operator": "==", "thresholdValue": "-1", "representation": "unknown", "text": "Unknown" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Healthy" } ] } }, { "columnMatch": "UsedCpu", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"UsedCpu\"] %", "columnSettings": [ { "columnName": "UsedCpu", "color": "blue" }, { "columnName": "AvailableCpu", "color": "gray" } ], "noRowsScaling": true } } }, { "columnMatch": "AvailableCpu", "formatter": 5 }, { "columnMatch": "MemoryUsage", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"MemoryUsage\"] %", "columnSettings": [ { "columnName": "UsedMemory", "color": "blue" }, { "columnName": "AvailableMemory", "color": "gray" } ], "noRowsScaling": true } } }, { "columnMatch": "UsedMemory", "formatter": 5 }, { "columnMatch": "AvailableMemory", "formatter": 5 }, { "columnMatch": "LogicalProcessors", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "21.2857ch" } }, { "columnMatch": "PhysicalProcessors", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10.1429ch" } }, { "columnMatch": "Uptime", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "CpuUsage", "formatter": 21, "formatOptions": { "min": 0, "max": 100, "palette": "green", "aggregation": "Max" }, "numberFormat": { "unit": 1, "options": { "style": "percent", "useGrouping": false } } } ], "filter": true, "labelSettings": [ { "columnId": "serverArmId", "label": "Nodes" }, { "columnId": "LastUpdated", "label": "Last updated" }, { "columnId": "UsedCpu", "label": "CPU usage" }, { "columnId": "MemoryUsage", "label": "Memory usage" }, { "columnId": "LogicalProcessors", "label": "Logical processors" }, { "columnId": "PhysicalProcessors", "label": "CPUs" }, { "columnId": "DomainGroup", "label": "Domain name" } ] } }, "name": "server query" }, { "type": 1, "content": { "json": "## Top VM CPU (Avg % Guest Run Time)" }, "name": "H1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let topN = 10;\r\nlet _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet startTs = iff(isnull(_start), ago(30d), _start);\r\nlet endTs = iff(isnull(_end), now(), _end);\r\nlet s = iff(startTs <= endTs, startTs, endTs);\r\nlet e = iff(startTs <= endTs, endTs, startTs);\r\n\r\nlet perVM =\r\n Perf\r\n | where TimeGenerated between (s .. e)\r\n | where ObjectName == \"Hyper-V Hypervisor Virtual Processor\"\r\n | where CounterName == \"% Guest Run Time\"\r\n | where InstanceName has \":Hv VP \" or InstanceName has \":VP \"\r\n | extend sep = iif(InstanceName has \":Hv VP \", \":Hv VP \", \":VP \")\r\n | extend VM = tostring(split(InstanceName, sep)[0])\r\n | where isnotempty(VM) and VM != \"_Total\"\r\n | summarize VMAvg = avg(CounterValue) by bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100), VM;\r\n\r\n// Top-N VMs by overall average within the window\r\nlet TopVMs =\r\n perVM\r\n | summarize Overall = avg(VMAvg) by VM\r\n | top topN by Overall desc\r\n | project VM;\r\n\r\nperVM\r\n| join kind=inner TopVMs on VM\r\n| project TimeGenerated, VM, VMAvg\r\n| order by VM asc, TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "VM", "exportParameterName": "SelectedVM_B", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "timechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "VM", "formatter": 1 }, "leftContent": { "columnMatch": "AvgCPU", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "VM", "formatter": 1 }, "centerContent": { "columnMatch": "AvgCPU", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "VMAvg" ], "group": "VM", "createOtherGroup": null, "showLegend": true, "xSettings": { "label": "Time" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } }, "label": "AvgCPU" } } }, "name": "Top VM CPU Usage", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "## Selected VM CPU Core Usage" }, "name": "H1 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f7ecfeb1-6b1d-4744-a542-9f2cdcec89f4", "version": "KqlParameterItem/1.0", "name": "SelectedVM_B", "type": 2, "allowCustom": true, "value": null, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "query": "let _start = todatetime('{TimeRange:start}'); let _end = todatetime('{TimeRange:end}'); let startTs = iff(isnull(_start), ago(30d), _start); let endTs = iff(isnull(_end), now(), _end); let s = iff(startTs <= endTs, startTs, endTs); let e = iff(startTs <= endTs, endTs, startTs); let topN = 10; Perf | where TimeGenerated between (s .. e) | where ObjectName == \"Hyper-V Hypervisor Virtual Processor\" | where CounterName == \"% Guest Run Time\" | where InstanceName has \":Hv VP \" or InstanceName has \":VP \" | extend sep = iif(InstanceName has \":Hv VP \", \":Hv VP \", \":VP \") | extend VM = tostring(split(InstanceName, sep)[0]) | where isnotempty(VM) and VM != \"_Total\" | summarize Overall = avg(CounterValue) by VM | top topN by Overall desc | project value = VM, label = VM | order by label asc", "label": "VM" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Local VM picker" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let targetVM = trim(\" \", tostring('{SelectedVM_B}'));\r\n\r\n// Resolve TimeRange safely\r\nlet _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet startTs = iff(isnull(_start), ago(30d), _start);\r\nlet endTs = iff(isnull(_end), now(), _end);\r\nlet s = iff(startTs <= endTs, startTs, endTs);\r\nlet e = iff(startTs <= endTs, endTs, startTs);\r\n\r\nPerf\r\n| where TimeGenerated between (s .. e)\r\n| where ObjectName == \"Hyper-V Hypervisor Virtual Processor\"\r\n| where CounterName == \"% Guest Run Time\"\r\n| where InstanceName has \":Hv VP \" or InstanceName has \":VP \"\r\n| extend sep = iif(InstanceName has \":Hv VP \", \":Hv VP \", \":VP \")\r\n| extend VM = tostring(split(InstanceName, sep)[0]),\r\n VP = tostring(split(InstanceName, sep)[1])\r\n| where isnotempty(VM) and VM != \"_Total\"\r\n| where isempty(targetVM) == false and VM == targetVM\r\n| summarize VPAvg = avg(CounterValue) by bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100), VM, VP\r\n| project TimeGenerated, VP, VPAvg, VM\r\n| order by TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "timechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "conditionalVisibility": { "parameterName": "SelectedVM_B", "comparison": "isNotEqualTo" }, "name": "Selected VM drill-down per vCPU" }, { "type": 1, "content": { "json": "## Total Virtual Processor usage per host (Total / Guest / Hyper-V)" }, "name": "H1 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet startTs = iff(isnull(_start), ago(30d), _start);\r\nlet endTs = iff(isnull(_end), now(), _end);\r\nlet s = iff(startTs <= endTs, startTs, endTs);\r\nlet e = iff(startTs <= endTs, endTs, startTs);\r\n\r\nPerf\r\n| where TimeGenerated between (s .. e)\r\n| where ObjectName == \"Hyper-V Hypervisor Virtual Processor\"\r\n| where InstanceName == \"_Total\"\r\n| where CounterName in (\"% Total Run Time\",\"% Guest Run Time\",\"% Hypervisor Run Time\")\r\n| summarize AvgVal = avg(CounterValue)\r\n by bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100), Computer, CounterName\r\n| project\r\n TimeGenerated,\r\n Series = strcat(Computer, \" - \",\r\n case(\r\n CounterName == \"% Total Run Time\", \"Total Run\",\r\n CounterName == \"% Guest Run Time\", \"Guest Run\",\r\n \"Hypervisor Run\"\r\n )\r\n ),\r\n Value = AvgVal\r\n| order by TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "timechart", "chartSettings": { "xAxis": "TimeGenerated", "group": "Series", "createOtherGroup": null, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "Total Virtual Processor usage per host" }, { "type": 1, "content": { "json": "## Total Hyper-V Logical CPU Usage (Hyper-V Logical Processor Total per Host)" }, "name": "H3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet startTs = iff(isnull(_start), ago(30d), _start);\r\nlet endTs = iff(isnull(_end), now(), _end);\r\nlet s = iff(startTs <= endTs, startTs, endTs);\r\nlet e = iff(startTs <= endTs, endTs, startTs);\r\n\r\nPerf\r\n| where TimeGenerated between (s .. e)\r\n| where ObjectName == \"Hyper-V Hypervisor Logical Processor\"\r\n| where CounterName == \"% Total Run Time\"\r\n| where InstanceName == \"_Total\"\r\n| summarize HostCPU = avg(CounterValue) by bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100), Computer\r\n| order by Computer asc, TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "timechart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "HostCPU" ], "showLegend": true, "xSettings": { "label": "Time" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } }, "min": 0, "max": 100, "label": "CPU Usage" } } }, "name": "Total Hyper-V Logical CPU Usage ", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "## Total CPU Usage pro Node (Physical)" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ArmId = Event\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\"\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\r\n| extend ArmPrefix = extract(@'(.+/)[^/]+$', 1, _ResourceId)\r\n| extend servers_information = parse_json(RenderedDescription).m_servers\r\n| mv-expand servers_information\r\n| extend Nodename = tostring(servers_information.m_name)\r\n| where Nodename in~ ({servers})\r\n| project _ResourceId = tolower(strcat(ArmPrefix, Nodename));\r\n\r\nPerf\r\n| where CounterName == \"% Processor Time\"\r\n| join kind=leftsemi ArmId on _ResourceId\r\n| project NodeName = split(Computer, \".\")[0], CpuUsage = CounterValue, TimeGenerated\r\n| summarize CpuUsage = avg(CpuUsage) by tostring(NodeName), bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100)\r\n\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "yAxis": [ "CpuUsage" ], "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } }, "min": 0, "max": 100 } } }, "name": "Total CPU Usage pro Node (Physical)" } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "TAB_CPU" }, "name": "CPU" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Azure Local Storage\r\nCluster level view of volume and drive health with status, capacity, resiliency, and filesystem, plus per volume performance. Charts track IOPS, throughput, and latency over your selected time range and cluster filter.\r\n" }, "name": "storage intro" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Volumes", "expandable": true, "expanded": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Health = Event\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\n| where TimeGenerated {TimeRange:query}\n| extend description = parse_json(RenderedDescription)\n| extend CorrelationId = tostring(description.CorrelationId)\n| where CorrelationId =~ '{lastCorrelationId}'\n| where tostring(description.Fault.ObjectType) == 'Microsoft.Health.EntityType.Volume'\n| extend ObjectId = tolower(tostring(description.Fault.ObjectId))\n| extend VolumeId = extract(\"volume{([^}]+)}\", 1, ObjectId)\n| extend Severity = toint(description.Fault.Severity)\n| extend Severity = iff(Severity > 2, -1, Severity)\n| summarize Status = max(Severity) by VolumeId;\n\nEvent\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3002\"\n| where TimeGenerated {TimeRange:query}\n| extend ClusterName = tostring(parse_xml(EventData).DataItem.UserData.EventData[\"ClusterName\"])\n| extend ClusterArmId = tostring(parse_xml(EventData).DataItem.UserData.EventData[\"ArmId\"])\n| where ClusterArmId =~ '{resource}'\n| extend volumes_information = parse_json(RenderedDescription).VolumeList\n| summarize arg_max(TimeGenerated,*) by ClusterName\n| mv-expand volumes_information\n| extend VolumeId = tostring(volumes_information.m_Id)\n| join kind=leftouter Health on VolumeId\n| extend VolumeWarning = iif(Status == 1, 1, 0)\n| extend VolumeCritical = iif(Status == 2, 1, 0)\n| extend VolumeUnknown = iif(Status == -1, 1, 0)\n| summarize Total = count(), Critical = sum(VolumeCritical), Warning = sum(VolumeWarning), Other = sum(VolumeUnknown)\n| project Total, Healthy = Total - (Critical + Warning + Other), Warning, Critical, Other\n| evaluate narrow()\n| extend Column = iff(Column == \"Total\", \"Total volumes\", Column)\n| project Column, tolong(Value)", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Column", "formatter": 1 }, "leftContent": { "columnMatch": "Value", "formatter": 12, "formatOptions": { "palette": "none" } }, "rightContent": { "columnMatch": "Column", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Warning", "representation": "2", "text": "" }, { "operator": "==", "thresholdValue": "Critical", "representation": "4", "text": "" }, { "operator": "==", "thresholdValue": "Other", "representation": "unknown", "text": "" }, { "operator": "==", "thresholdValue": "Healthy", "representation": "success", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "" } ] } }, "showBorder": false } }, "name": "volume health tiles" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Health = Event\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\n| where TimeGenerated {TimeRange:query}\n| extend description = parse_json(RenderedDescription)\n| extend CorrelationId = tostring(description.CorrelationId)\n| where CorrelationId =~ '{lastCorrelationId}'\n| where tostring(description.Fault.ObjectType) == 'Microsoft.Health.EntityType.Volume'\n| extend ObjectId = tolower(tostring(description.Fault.ObjectId))\n| extend VolumeId = extract(\"volume{([^}]+)}\", 1, ObjectId)\n| extend Severity = toint(description.Fault.Severity)\n| extend Severity = iff(Severity > 2, -1, Severity)\n| summarize Status = max(Severity) by VolumeId;\n\nEvent\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3002\"\n| where TimeGenerated {TimeRange:query}\n| extend ClsuterData = parse_xml(EventData)\n| extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\n| where ClusterArmId =~ '{resource}'\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\n| extend volumes_information = parse_json(RenderedDescription).VolumeList\n| mv-expand volumes_information\n| extend VolumeId = tostring(volumes_information.m_Id)\n| join kind=leftouter Health on VolumeId\n| extend TotalCap = tolong(volumes_information.m_Size)\n| extend AvailableCap = TotalCap - tolong(volumes_information.m_SizeUsed)\n| extend Resiliency = toint(volumes_information.m_Resiliency)\n| extend Resiliency = case(Resiliency == 1, \"Simple\", Resiliency == 2, \"Single Parity\", Resiliency == 3, \"Dual Parity\", Resiliency == 4, \"Two Way Mirror\", Resiliency == 5, \"Three Way Mirror\", Resiliency == 6, \"MRT\", \"Unknown\")\n| extend Iops = todouble(volumes_information.m_TotalIops)\n| extend Throughput = todouble(volumes_information.m_TotalThroughput)\n| extend Latency = todouble(volumes_information.m_AverageLatency)\n| project Volumes = tostring(volumes_information.m_Label), LastUpdated = TimeGenerated, Status,\n TotalCap, AvailableCap,\n Iops = iff(Iops < 0, 0.0, Iops),\n Throughput = iff(Throughput < 0, 0.0, Throughput),\n Latency = iff(Latency < 0, 0.0, Latency),\n Resiliency, Deduplication = iff(tobool(volumes_information.m_IsDedupEnabled), \"Yes\", \"No\"),\n FileSystem = tostring(volumes_information.m_FileSystem)", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Volumes", "formatter": 1 }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "2", "text": "Warning" }, { "operator": "==", "thresholdValue": "2", "representation": "4", "text": "Critical" }, { "operator": "==", "thresholdValue": "-1", "representation": "unknown", "text": "Unknown" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Healthy" } ] } }, { "columnMatch": "TotalCap", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "AvailableCap", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "Iops", "formatter": 0, "numberFormat": { "unit": 31, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "Throughput", "formatter": 0, "numberFormat": { "unit": 11, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "Latency", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } } ], "filter": true, "sortBy": [ { "itemKey": "Volumes", "sortOrder": 1 } ], "labelSettings": [ { "columnId": "LastUpdated", "label": "Last updated" }, { "columnId": "TotalCap", "label": "Total capacity" }, { "columnId": "AvailableCap", "label": "Available capacity" }, { "columnId": "FileSystem", "label": "File system" } ] }, "sortBy": [ { "itemKey": "Volumes", "sortOrder": 1 } ] }, "name": "volume info table" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "15e4aa47-e8e7-43c1-b587-666848241b29", "version": "KqlParameterItem/1.0", "name": "selectedVolumes", "label": "Volumes", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Event\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3002\"\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\r\n| extend volumes_information = parse_json(RenderedDescription).VolumeList\r\n| mv-expand volumes_information\r\n| extend Label = tostring(volumes_information.m_Label)\r\n| distinct Label", "crossComponentResources": [ "{WorkSpaces}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "chart parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Event\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\n| where EventLog =~ 'Microsoft-Windows-SDDC-Management/Operational' and EventID == '3002'\n| where TimeGenerated {TimeRange:query}\n| extend ClusterArmId = tostring(parse_xml(EventData).DataItem.UserData.EventData['ArmId'])\n| where ClusterArmId =~ '{resource}'\n| extend volumes_information = parse_json(RenderedDescription).VolumeList\n| mv-expand volumes_information\n| extend Label = tostring(volumes_information.m_Label)\n| where Label in~ ({selectedVolumes})\n| extend Iops = todouble(volumes_information.m_TotalIops)\n| extend Iops = iff(Iops < 0, 0.0, Iops)\n| summarize Iops = sum(Iops) by bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100), Label\n| order by Label asc", "size": 0, "title": "IOPS", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart" }, "customWidth": "33", "name": "iops chart", "styleSettings": { "padding": "10", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Event\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\n| where EventLog =~ 'Microsoft-Windows-SDDC-Management/Operational' and EventID == '3002'\n| where TimeGenerated {TimeRange:query}\n| extend ClusterArmId = tostring(parse_xml(EventData).DataItem.UserData.EventData['ArmId'])\n| where ClusterArmId =~ '{resource}'\n| extend volumes_information = parse_json(RenderedDescription).VolumeList\n| mv-expand volumes_information\n| extend Label = tostring(volumes_information.m_Label)\n| where Label in~ ({selectedVolumes})\n| extend Throughput = todouble(volumes_information.m_TotalThroughput)\n| extend Throughput = iff(Throughput < 0, 0.0, Throughput)\n| summarize Throughput = sum(Throughput) by bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100), Label\n| order by Label asc", "size": 0, "title": "Throughput", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart" }, "customWidth": "33", "name": "throughput chart", "styleSettings": { "padding": "10", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Event\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\n| where EventLog =~ 'Microsoft-Windows-SDDC-Management/Operational' and EventID == '3002'\n| where TimeGenerated {TimeRange:query}\n| extend ClusterArmId = tostring(parse_xml(EventData).DataItem.UserData.EventData['ArmId'])\n| where ClusterArmId =~ '{resource}'\n| extend volumes_information = parse_json(RenderedDescription).VolumeList\n| mv-expand volumes_information\n| extend Label = tostring(volumes_information.m_Label)\n| where Label in~ ({selectedVolumes})\n| extend Latency = todouble(volumes_information.m_AverageLatency)\n| extend Latency = iff(Latency < 0, 0.0, Latency)\n| summarize Latency = avg(Latency) by bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100), Label\n| order by Label asc", "size": 0, "title": "Latency", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart" }, "customWidth": "33", "name": "latency chart", "styleSettings": { "padding": "10", "maxWidth": "33%" } } ] }, "name": "volumes group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Drives", "expandable": true, "expanded": true, "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{loganalytics}" ], "parameters": [ { "id": "40b3d7b9-bb19-4978-8bdc-4c2f7af19ff7", "version": "KqlParameterItem/1.0", "name": "lastCorrelationId", "type": 2, "query": "Event\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3001\" \r\n| where TimeGenerated {TimeRange:query}\r\n| extend ClusterName = tostring(parse_xml(EventData).DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(parse_xml(EventData).DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| extend Description = parse_json(RenderedDescription)\r\n| where tostring(Description.m_isLastElement) == \"true\"\r\n| extend CorrelationId = tostring(Description.m_correlationId)\r\n| summarize arg_max(TimeGenerated, CorrelationId) by ClusterArmId\r\n| project CorrelationId;", "crossComponentResources": [ "{WorkSpaces}" ], "isHiddenWhenLocked": true, "typeSettings": { "additionalResourceOptions": [ "value::1" ] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::1", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "f23b8776-9931-4338-916b-f77df5371a87", "version": "KqlParameterItem/1.0", "name": "totalDrives", "type": 2, "isRequired": true, "query": "Event\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3001\"\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| extend Description = parse_json(RenderedDescription)\r\n| extend CorrelationId = tostring(Description.m_correlationId)\r\n| where CorrelationId =~ '{lastCorrelationId}'\r\n| extend drives_information = Description.m_drives\r\n| where array_length(drives_information) > 0\r\n| mv-expand drives_information\r\n| summarize Total = count()", "crossComponentResources": [ "{WorkSpaces}" ], "isHiddenWhenLocked": true, "typeSettings": { "additionalResourceOptions": [ "value::1" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::1", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "drive parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Event\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\n| extend description = parse_json(RenderedDescription)\n| extend CorrelationId = tostring(description.CorrelationId)\n| where CorrelationId =~ '{lastCorrelationId}'\n| where tostring(description.Fault.RootObjectType) == 'Microsoft.Health.EntityType.PhysicalDisk'\n| extend Severity = toint(description.Fault.Severity)\n| summarize Total = {totalDrives}, Critical = countif(Severity == 2), Warning = countif(Severity == 1), Other = countif(Severity == 255)\n| project Total, Healthy = Total - (Critical + Warning + Other), Warning, Critical, Other\n| evaluate narrow()", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Column", "formatter": 1 }, "leftContent": { "columnMatch": "Value", "formatter": 12, "formatOptions": { "palette": "none" } }, "rightContent": { "columnMatch": "Column", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Total", "text": "" }, { "operator": "==", "thresholdValue": "Critical", "representation": "4", "text": "" }, { "operator": "==", "thresholdValue": "Warning", "representation": "2", "text": "" }, { "operator": "==", "thresholdValue": "Other", "representation": "unknown", "text": "" }, { "operator": "==", "thresholdValue": "Healthy", "representation": "success", "text": "" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "" } ] } }, "showBorder": false } }, "name": "drive health tiles" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Health = Event\n| where EventLog =~ 'Microsoft-Windows-Health/Operational'\n| where TimeGenerated {TimeRange:query}\n| extend description = parse_json(RenderedDescription)\n| extend CorrelationId = tostring(description.CorrelationId)\n| where CorrelationId =~ '{lastCorrelationId}'\n| where tostring(description.Fault.RootObjectType) == 'Microsoft.Health.EntityType.PhysicalDisk'\n| extend driveId = tostring(description.Fault.RootObjectId)\n| extend Severity = toint(description.Fault.Severity)\n| extend Severity = iff(Severity > 2, -1, Severity)\n| summarize Status = max(Severity) by driveId;\n\nEvent\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\n| where EventLog =~ 'Microsoft-Windows-SDDC-Management/Operational' and EventID == '3001'\n| where TimeGenerated {TimeRange:query}\n| extend ClsuterData = parse_xml(EventData)\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData['ArmId'])\n| where ClusterArmId =~ '{resource}'\n| extend Description = parse_json(RenderedDescription)\n| extend CorrelationId = tostring(Description.m_correlationId)\n| where CorrelationId =~ '{lastCorrelationId}'\n| extend drives_information = Description.m_drives\n| where array_length(drives_information) > 0\n| mv-expand drives_information\n| extend driveId = tostring(drives_information.m_uniqueId)\n| join kind=leftouter Health on driveId\n| extend TotalCapacity = tolong(drives_information.m_sizeInBytes)\n| extend AvailableCapacity = TotalCapacity - tolong(drives_information.m_sizeUsedInBytes)\n| project Drives = driveId, LastUpdated = TimeGenerated, Status, AvailableCapacity, TotalCapacity, CanPool = iff(tobool(drives_information.m_canPool), 'Yes', 'No')", "size": 0, "showAnalytics": true, "noDataMessage": "Install the latest OS update on this cluster to show complete drive info.", "noDataMessageStyle": 4, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Drives", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "70ch" } }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "2", "text": "Warning" }, { "operator": "==", "thresholdValue": "2", "representation": "4", "text": "Critical" }, { "operator": "==", "thresholdValue": "-1", "representation": "unknown", "text": "Unknown" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Healthy" } ] } }, { "columnMatch": "AvailableCapacity", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } }, { "columnMatch": "TotalCapacity", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal" } } } ], "filter": true, "labelSettings": [ { "columnId": "LastUpdated", "label": "Last updated" }, { "columnId": "AvailableCapacity", "label": "Available capacity" }, { "columnId": "TotalCapacity", "label": "Total capacity" }, { "columnId": "CanPool", "label": "Can pool?" } ] } }, "name": "drive info table" } ] }, "name": "drives group" } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "TAB_STORAGE" }, "name": "Storage" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Azure Local Network\r\nCluster and VM traffic at a glance: RDMA and non RDMA throughput per node, plus VM NIC throughput with a drill down for any selected VM. Honors your time range and cluster filters.\r\n" }, "name": "Network Disclaimer" }, { "type": 1, "content": { "json": "## Cluster Network Troughtput " }, "name": "Cluster Network Troughtput" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ArmId = Event\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\"\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\r\n| extend ArmPrefix = extract(@'(.+/)[^/]+$', 1, _ResourceId)\r\n| extend servers_information = parse_json(RenderedDescription).m_servers\r\n| mv-expand servers_information\r\n| extend Nodename = tostring(servers_information.m_name)\r\n| where Nodename in~ ({servers})\r\n| project _ResourceId = tolower(strcat(ArmPrefix, Nodename));\r\n\r\nPerf\r\n| where ObjectName == \"RDMA Activity\"\r\n| summarize Computer = any(Computer), _ResourceId = any(_ResourceId), RdmaUsage = sum(CounterValue) by TimeGenerated\r\n| join kind=leftsemi ArmId on _ResourceId\r\n| project NodeName = split(Computer, \".\")[0], RdmaUsage, TimeGenerated\r\n| summarize RdmaUsage = avg(RdmaUsage) by tostring(NodeName), bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100)\r\n", "size": 0, "showAnalytics": true, "title": "RDMA", "noDataMessage": "There are no RDMA performance data or RDMA performance counters are not configured", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "yAxis": [ "RdmaUsage" ], "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 11, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "RDMA" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ArmId = Event\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\"\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\r\n| extend ArmPrefix = extract(@'(.+/)[^/]+$', 1, _ResourceId)\r\n| extend servers_information = parse_json(RenderedDescription).m_servers\r\n| mv-expand servers_information\r\n| extend Nodename = tostring(servers_information.m_name)\r\n| where Nodename in~ ({servers})\r\n| project _ResourceId = tolower(strcat(ArmPrefix, Nodename));\r\n\r\nPerf\r\n| where ObjectName == \"Network Interface\"\r\n| summarize Computer = any(Computer), _ResourceId = any(_ResourceId), NetworkUsage = sum(CounterValue) by TimeGenerated\r\n| join kind=leftsemi ArmId on _ResourceId\r\n| project NodeName = split(Computer, \".\")[0], NetworkUsage, TimeGenerated\r\n| summarize NetworkUsage = avg(NetworkUsage) by tostring(NodeName), bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100)\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "title": "Non RDMA", "noDataMessage": "There are no networking performance data or networking performance counters are not configured", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "yAxis": [ "NetworkUsage" ], "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 11, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "Non RDMA" }, { "type": 1, "content": { "json": "## VM Network Throughput" }, "name": "VM Network Troughtput" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet startTs = iff(isnull(_start), ago(30d), _start);\r\nlet endTs = iff(isnull(_end), now(), _end);\r\nlet s = iff(startTs <= endTs, startTs, endTs);\r\nlet e = iff(startTs <= endTs, endTs, startTs);\r\nlet topN = 10;\r\nlet binSpan = totimespan({TimeRange:end} - {TimeRange:start})/100;\r\n\r\nlet perNIC =\r\n Perf\r\n | where TimeGenerated between (s .. e)\r\n | where ObjectName == \"Hyper-V Virtual Network Adapter\"\r\n | where CounterName in (\"Bytes Received/sec\",\"Bytes Sent/sec\")\r\n // exclude host team/DEVICE adapters\r\n | where not(InstanceName startswith \"__TEAMNIC_\")\r\n | where InstanceName !contains \"__DEVICE\"\r\n // normalize labels\r\n | extend RawName = tostring(InstanceName)\r\n | extend NoSum = replace_regex(RawName, @\"\\s*\\(Sum\\)\\s*$\", \"\")\r\n | extend NICLabel =\r\n iif(indexof(NoSum, \"]\") >= 0,\r\n extract(@\"^(.*\\])\", 1, NoSum), // keep up to trailing ]\r\n replace_regex(NoSum, @\"_[^_]+$\", \"\")) // otherwise drop last _\r\n | summarize\r\n RxBps = avg(iff(CounterName == \"Bytes Received/sec\", CounterValue, real(null))),\r\n TxBps = avg(iff(CounterName == \"Bytes Sent/sec\", CounterValue, real(null)))\r\n by bin(TimeGenerated, binSpan), NICLabel\r\n | extend TotalBps = coalesce(RxBps,0.0) + coalesce(TxBps,0.0);\r\n\r\nlet TopNICs =\r\n perNIC\r\n | summarize Overall = avg(TotalBps) by NICLabel\r\n | top topN by Overall desc\r\n | project NICLabel;\r\n\r\nperNIC\r\n| join kind=inner TopNICs on NICLabel\r\n| project TimeGenerated, NIC = NICLabel, TotalBps\r\n| order by NIC asc, TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "TotalBps" ], "group": "NIC", "createOtherGroup": null, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 11, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } }, "label": "" } } }, "name": "VM Network Throughput" }, { "type": 1, "content": { "json": "## Selected VM Througput" }, "name": "text - 6" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "558a6d04-8ad8-44dd-8170-c25503c4c73e", "version": "KqlParameterItem/1.0", "name": "SelectedVM_N", "type": 2, "label": "VM (NIC)", "allowCustom": true, "query": "let _start = todatetime('{TimeRange:start}'); let _end = todatetime('{TimeRange:end}'); let s = iff(isnull(_start), ago(30d), _start); let e = iff(isnull(_end), now(), _end); let topN = 10; let binSpan = totimespan({TimeRange:end} - {TimeRange:start})/100; let perNIC = Perf | where TimeGenerated between (s .. e) | where ObjectName == \"Hyper-V Virtual Network Adapter\" | where CounterName in (\"Bytes Received/sec\",\"Bytes Sent/sec\") | where not(InstanceName startswith \"__TEAMNIC_\") | where InstanceName !contains \"__DEVICE\" | extend RawName = tostring(InstanceName) | extend NoSum = replace_regex(RawName, \"\\\\s*\\\\(Sum\\\\)\\\\s*$\", \"\") | extend NICLabel = iif(indexof(NoSum, \"]\") >= 0, substring(NoSum, 0, indexof(NoSum, \"]\") + 1), replace_regex(NoSum, \"_[^_]+$\", \"\")) | summarize RxBps = avg(iff(CounterName == \"Bytes Received/sec\", CounterValue, real(null))), TxBps = avg(iff(CounterName == \"Bytes Sent/sec\", CounterValue, real(null))) by bin(TimeGenerated, binSpan), NICLabel | extend TotalBps = coalesce(RxBps, 0.0) + coalesce(TxBps, 0.0); perNIC | summarize Overall = avg(TotalBps) by NICLabel | top topN by Overall desc | project value = NICLabel, label = NICLabel | order by label asc", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Selected VM (Network)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet s = iff(isnull(_start), ago(30d), _start);\r\nlet e = iff(isnull(_end), now(), _end);\r\nlet binSpan = totimespan({TimeRange:end} - {TimeRange:start})/100;\r\nlet target = trim(\" \", tostring('{SelectedVM_N}'));\r\n\r\n// Rx/Tx per selected NIC (MB/s), stacked as Metric=Rx/Tx\r\nPerf\r\n| where TimeGenerated between (s .. e)\r\n| where ObjectName == \"Hyper-V Virtual Network Adapter\"\r\n| where CounterName in (\"Bytes Received/sec\",\"Bytes Sent/sec\")\r\n| where not(InstanceName startswith \"__TEAMNIC_\")\r\n| where InstanceName !contains \"__DEVICE\"\r\n| extend RawName = tostring(InstanceName)\r\n| extend NoSum = replace_regex(RawName, \"\\\\s*\\\\(Sum\\\\)\\\\s*$\", \"\")\r\n| extend NICLabel =\r\n iif(indexof(NoSum, \"]\") >= 0,\r\n substring(NoSum, 0, indexof(NoSum, \"]\") + 1),\r\n replace_regex(NoSum, \"_[^_]+$\", \"\"))\r\n| where isempty(target) == false and NICLabel == target\r\n| summarize\r\n RxBps = avg(iff(CounterName == \"Bytes Received/sec\", CounterValue, real(null))),\r\n TxBps = avg(iff(CounterName == \"Bytes Sent/sec\", CounterValue, real(null)))\r\n by bin(TimeGenerated, binSpan)\r\n| extend RxMBps = coalesce(RxBps,0.0) / 1e6,\r\n TxMBps = coalesce(TxBps,0.0) / 1e6\r\n| extend metrics = pack_array(\r\n pack(\"Metric\",\"Recived MB/s\",\"Value\", RxMBps),\r\n pack(\"Metric\",\"Transmitted MB/s\",\"Value\", TxMBps)\r\n )\r\n| mv-expand metrics\r\n| extend Metric = tostring(metrics.Metric), Value = todouble(metrics.Value)\r\n| project TimeGenerated, Metric, Value\r\n| order by TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "Value" ], "group": "Metric", "createOtherGroup": null, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 13, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } }, "min": 0, "label": "MB/s" } } }, "conditionalVisibility": { "parameterName": "SelectedVM_N", "comparison": "isNotEqualTo" }, "name": "Selected VM Network In/Out (MB/s)" } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "TAB_NETWORK" }, "name": "Network" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Azure Local RAM\r\nQuick view of memory across your environment: VM memory percent and bytes, plus a drill down for any selected VM. Honors your time range and filters.\r\n" }, "name": "text - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Health = Event\r\n| where EventLog =~ \"Microsoft-Windows-Health/Operational\"\r\n| extend description = parse_json(RenderedDescription)\r\n| extend CorrelationId = tostring(description.CorrelationId)\r\n| where CorrelationId =~ '{lastCorrelationId}'\r\n| where tostring(description.Fault.ObjectType) == 'Microsoft.Health.EntityType.Server'\r\n| extend NodeId = tolower(tostring(description.Fault.ObjectId))\r\n| extend Severity = toint(description.Fault.Severity)\r\n| extend Severity = iff(Severity > 2, -1, Severity)\r\n| summarize Status = max(Severity) by NodeId;\r\n\r\nEvent\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\"\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\r\n| extend ArmPrefix = extract(@'(.+/)[^/]+$', 1, _ResourceId)\r\n| extend servers_information = parse_json(RenderedDescription).m_servers\r\n| mv-expand servers_information\r\n| extend Nodename = tostring(servers_information.m_name)\r\n| extend NodeId = tolower(Nodename)\r\n| join kind=leftouter Health on NodeId\r\n| extend serverArmId = strcat(ArmPrefix, Nodename)\r\n| extend UsedCpu = toint(servers_information.m_totalProcessorsUsedPercentage)\r\n| extend AvailableCpu = 100 - UsedCpu\r\n| extend TotalMemory = todecimal(servers_information.m_totalPhysicalMemoryInBytes)\r\n| extend UsedMemory = iff(TotalMemory == 0.0, todecimal(0.0), todecimal(servers_information.m_usedPhysicalMemoryInBytes))\r\n| extend AvailableMemory = iff(TotalMemory == 0.0, todecimal(1.0), todecimal(TotalMemory - UsedMemory))\r\n| extend MemoryUsage = iff(TotalMemory == 0.0, todecimal(0.0), todecimal(round(UsedMemory/TotalMemory*100, 0)))\r\n| extend LogicalProcessors = toint(servers_information.m_totalLogicalProcessors)\r\n| extend PhysicalProcessors = toint(servers_information.m_totalPhysicalProcessors)\r\n| extend Site = tostring(servers_information.m_site)\r\n| extend Uptime = tolong(servers_information.m_uptimeInSeconds)\r\n| extend DomainGroup = extract(@'[^\\.]+\\.(.+)', 1, Computer)\r\n| order by tolower(Nodename) asc\r\n| project serverArmId, Nodename, LastUpdated = TimeGenerated, Status, UsedCpu, AvailableCpu, MemoryUsage, UsedMemory, AvailableMemory, LogicalProcessors, PhysicalProcessors, Uptime, Site, DomainGroup", "size": 3, "showAnalytics": true, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "serverArmId", "formatter": 13, "formatOptions": { "linkTarget": "Resource", "subTarget": "insights", "showIcon": true } }, { "columnMatch": "Nodename", "formatter": 5 }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "2", "text": "Warning" }, { "operator": "==", "thresholdValue": "2", "representation": "4", "text": "Critical" }, { "operator": "==", "thresholdValue": "-1", "representation": "unknown", "text": "Unknown" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Healthy" } ] } }, { "columnMatch": "UsedCpu", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"UsedCpu\"] %", "columnSettings": [ { "columnName": "UsedCpu", "color": "blue" }, { "columnName": "AvailableCpu", "color": "gray" } ], "noRowsScaling": true } } }, { "columnMatch": "AvailableCpu", "formatter": 5 }, { "columnMatch": "MemoryUsage", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"MemoryUsage\"] %", "columnSettings": [ { "columnName": "UsedMemory", "color": "blue" }, { "columnName": "AvailableMemory", "color": "gray" } ], "noRowsScaling": true } } }, { "columnMatch": "UsedMemory", "formatter": 5 }, { "columnMatch": "AvailableMemory", "formatter": 5 }, { "columnMatch": "LogicalProcessors", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "21.2857ch" } }, { "columnMatch": "PhysicalProcessors", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10.1429ch" } }, { "columnMatch": "Uptime", "formatter": 0, "numberFormat": { "unit": 24, "options": { "style": "decimal" } } }, { "columnMatch": "CpuUsage", "formatter": 21, "formatOptions": { "min": 0, "max": 100, "palette": "green", "aggregation": "Max" }, "numberFormat": { "unit": 1, "options": { "style": "percent", "useGrouping": false } } } ], "filter": true, "labelSettings": [ { "columnId": "serverArmId", "label": "Nodes" }, { "columnId": "LastUpdated", "label": "Last updated" }, { "columnId": "UsedCpu", "label": "CPU usage" }, { "columnId": "MemoryUsage", "label": "Memory usage" }, { "columnId": "LogicalProcessors", "label": "Logical processors" }, { "columnId": "PhysicalProcessors", "label": "CPUs" }, { "columnId": "DomainGroup", "label": "Domain name" } ] } }, "name": "server query" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let ArmId = Event\r\n| where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n| where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\"\r\n| extend ClsuterData = parse_xml(EventData)\r\n| extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\r\n| extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n| where ClusterArmId =~ '{resource}'\r\n| summarize arg_max(TimeGenerated,*) by ClusterArmId\r\n| extend ArmPrefix = extract(@'(.+/)[^/]+$', 1, _ResourceId)\r\n| extend servers_information = parse_json(RenderedDescription).m_servers\r\n| mv-expand servers_information\r\n| extend Nodename = tostring(servers_information.m_name)\r\n| where Nodename in~ ({servers})\r\n| project _ResourceId = tolower(strcat(ArmPrefix, Nodename)), TotalMemoryInBytes = todecimal(servers_information.m_totalPhysicalMemoryInBytes);\r\n\r\nPerf\r\n| where ObjectName == \"Memory\"\r\n| where CounterName == \"Available Bytes\"\r\n| join kind=inner ArmId on _ResourceId\r\n| project NodeName = split(Computer, \".\")[0], MemoryUsage = (TotalMemoryInBytes - todecimal(CounterValue))/TotalMemoryInBytes*100, TimeGenerated\r\n| summarize MemoryUsage = avg(MemoryUsage) by tostring(NodeName), bin(TimeGenerated, totimespan({TimeRange:end} - {TimeRange:start})/100)", "size": 0, "aggregation": 3, "showAnalytics": true, "title": "Memory usage %", "noDataMessage": "There are no memory performance data or memory performance counters are not configured", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "yAxis": [ "MemoryUsage" ], "group": "NodeName", "createOtherGroup": null, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2 } }, "min": 0, "max": 100 } } }, "customWidth": "50", "name": "memory usage query" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet s = iff(isnull(_start), ago(30d), _start);\r\nlet e = iff(isnull(_end), now(), _end);\r\nlet binSpan = totimespan({TimeRange:end} - {TimeRange:start})/100;\r\n\r\n// Set output unit: GB (use 1024.0*1024.0 for MB if you prefer)\r\nlet unitDiv = 1024.0*1024.0;\r\n\r\n// Cluster nodes + total memory (bytes) from Event 3000\r\nlet ArmId =\r\n Event\r\n | where _ResourceId !contains '/Microsoft.AzureStackHCI/'\r\n | where EventLog =~ \"Microsoft-Windows-SDDC-Management/Operational\" and EventID == \"3000\"\r\n | extend ClsuterData = parse_xml(EventData)\r\n | extend ClusterName = tostring(ClsuterData.DataItem.UserData.EventData[\"ClusterName\"])\r\n | extend ClusterArmId = tostring(ClsuterData.DataItem.UserData.EventData[\"ArmId\"])\r\n | where ClusterArmId =~ '{resource}'\r\n | summarize arg_max(TimeGenerated, *) by ClusterArmId\r\n | extend ArmPrefix = extract(@'(.+/)[^/]+$', 1, _ResourceId)\r\n | extend servers_information = parse_json(RenderedDescription).m_servers\r\n | mv-expand servers_information\r\n | extend NodeName = tostring(servers_information.m_name)\r\n | where NodeName in~ ({servers})\r\n | project _ResourceId = tolower(strcat(ArmPrefix, NodeName)),\r\n NodeName,\r\n TotalMemoryInBytes = todouble(servers_information.m_totalPhysicalMemoryInBytes);\r\n\r\n// Memory trend from Perf (Available Bytes) + convert to Used/Free in GB\r\nlet MemTrend =\r\n Perf\r\n | where TimeGenerated between (s .. e)\r\n | where ObjectName == \"Memory\" and CounterName == \"Available Bytes\"\r\n | join kind=inner ArmId on _ResourceId\r\n | summarize\r\n AvailBytes = avg(todouble(CounterValue)),\r\n TotalBytes = any(TotalMemoryInBytes)\r\n by NodeName, bin(TimeGenerated, binSpan)\r\n | extend\r\n FreeGB = AvailBytes / unitDiv,\r\n UsedGB = (TotalBytes - AvailBytes) / unitDiv,\r\n TotalGB = TotalBytes / unitDiv;\r\n\r\n// Emit two series per node: \"Node - Used\" and \"Node - Free\"\r\nMemTrend\r\n| project TimeGenerated, Series = strcat(NodeName, \" - Used\"), Value = UsedGB\r\n| union\r\n (MemTrend | project TimeGenerated, Series = strcat(NodeName, \" - Free\"), Value = FreeGB)\r\n| order by Series asc, TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "title": "Memory usage in Bytes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "ySettings": { "numberFormatSettings": { "unit": 4, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "Node RAM in Bytes" } ] }, "name": "Cluster RAM" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "VM RAM", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet startTs = iff(isnull(_start), ago(30d), _start);\r\nlet endTs = iff(isnull(_end), now(), _end);\r\nlet s = iff(startTs <= endTs, startTs, endTs);\r\nlet e = iff(startTs <= endTs, endTs, startTs);\r\nlet binSpan = totimespan({TimeRange:end} - {TimeRange:start})/100;\r\nlet topN = 10;\r\n\r\nlet perVM =\r\n Perf\r\n | where TimeGenerated between (s .. e)\r\n | where ObjectName == \"Hyper-V Dynamic Memory VM\"\r\n | where CounterName == \"Guest Visible Physical Memory\"\r\n | where isnotempty(InstanceName) and InstanceName != \"_Total\"\r\n | summarize MemMB = avg(CounterValue)\r\n by bin(TimeGenerated, binSpan), VM = tostring(InstanceName);\r\n\r\nlet TopVMs =\r\n perVM\r\n | summarize Overall = avg(MemMB) by VM\r\n | top topN by Overall desc\r\n | project VM;\r\n\r\nperVM\r\n| join kind=inner TopVMs on VM\r\n| project TimeGenerated, VM, MemMB\r\n| order by VM asc, TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "yAxis": [ "MemMB" ], "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 4, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } }, "label": "Memory" } } }, "name": "query - 0" }, { "type": 1, "content": { "json": "## Selected VM RAM" }, "name": "text - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7a2f3b1a-4f5a-4d0b-9b6a-6e1d5a4d9c12", "version": "KqlParameterItem/1.0", "name": "SelectedVM_C", "type": 2, "allowCustom": true, "label": "VM", "query": "let _start=todatetime('{TimeRange:start}'); let _end=todatetime('{TimeRange:end}'); let s=iff(isnull(_start),ago(30d),_start); let e=iff(isnull(_end),now(),_end); Perf | where TimeGenerated between (s .. e) | where ObjectName == 'Hyper-V Dynamic Memory VM' | where CounterName == 'Guest Visible Physical Memory' | where isnotempty(InstanceName) and InstanceName != '_Total' | summarize by VM=tostring(InstanceName) | project value=VM, label=VM | order by label asc", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Selected VM (Memory)" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let _start = todatetime('{TimeRange:start}');\r\nlet _end = todatetime('{TimeRange:end}');\r\nlet s = iff(isnull(_start), ago(30d), _start);\r\nlet e = iff(isnull(_end), now(), _end);\r\nlet binSpan = totimespan({TimeRange:end} - {TimeRange:start})/100;\r\nlet targetVM = trim(\" \", tostring('{SelectedVM_C}'));\r\n\r\nPerf\r\n| where TimeGenerated between (s .. e)\r\n| where ObjectName == \"Hyper-V Dynamic Memory VM\"\r\n| where isnotempty(targetVM) and InstanceName == targetVM\r\n| where CounterName in (\"Guest Visible Physical Memory\",\"Physical Memory\",\"Memory Demand\")\r\n| summarize ValMB = avg(CounterValue)\r\n by bin(TimeGenerated, binSpan),\r\n Series = case(\r\n CounterName == \"Physical Memory\", \"Assigned (MB)\",\r\n CounterName == \"Memory Demand\", \"Demand (MB)\",\r\n \"Guest Visible (MB)\")\r\n| order by TimeGenerated asc\r\n", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{WorkSpaces}" ], "visualization": "linechart", "chartSettings": { "xAxis": "TimeGenerated", "group": "Series", "createOtherGroup": null, "showLegend": true, "ySettings": { "numberFormatSettings": { "unit": 4, "options": { "style": "decimal", "useGrouping": true } } } } }, "conditionalVisibility": { "parameterName": "SelectedVM_C", "comparison": "isNotEqualTo", "value": "" }, "name": "Selected VM RAM" } ] }, "name": "VM RAM" } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "TAB_RAM" }, "name": "RAM" } ] }, "name": "Azure Local Monitoring Workbook" } ], "fallbackResourceIds": [ "azure monitor" ], "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }