{"id":4524,"date":"2019-05-23T09:14:32","date_gmt":"2019-05-23T07:14:32","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=4524"},"modified":"2019-05-23T09:15:18","modified_gmt":"2019-05-23T07:15:18","slug":"monitor-a-process-with-azure-monitor","status":"publish","type":"post","link":"http:\/\/contoso.se\/blog\/?p=4524","title":{"rendered":"Monitor a process with Azure Monitor"},"content":{"rendered":"\n<p>A common question when working with Azure Monitor is\nmonitoring of Windows services and processes running on Windows servers. In\nAzure Monitor we can monitor Windows Services and other processes the same way;\nby looking at process ID as a performance counter. <\/p>\n\n\n\n<p>Even if a process can be monitored by looking at events, it\nis not always a reliable source. The challenge is that there is no \u00e2\u20ac\u0153active\nmonitoring\u00e2\u20ac\u009d checking if the process is running at the moment when looking at\nonly events.&nbsp; <\/p>\n\n\n\n<p>Each process writes a number of performance counters. None of these are collected by default in Azure Monitor, but easy to add under Windows Performance Counters. <\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image.png\" target=\"_blank\" rel=\"noreferrer noopener\"><img decoding=\"async\" loading=\"lazy\" width=\"624\" height=\"152\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image.png\" alt=\"\" class=\"wp-image-4525\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image.png 624w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image-300x73.png 300w\" sizes=\"(max-width: 624px) 100vw, 624px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" loading=\"lazy\" width=\"624\" height=\"479\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image-1.png\" alt=\"\" class=\"wp-image-4527\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image-1.png 624w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image-1-300x230.png 300w\" sizes=\"(max-width: 624px) 100vw, 624px\" \/><figcaption> <br \/><\/figcaption><\/figure>\n\n\n\n<p>The following query will show process ID for Notepad. If the Notepad process is not running, there will be no data. The alert rule, if needed, can be configured to generate an alert if zero results was returned during the last X minutes. <\/p>\n\n\n\n<p>Perf<br \/> | where (Computer == &#8220;LND-DC-001.vnext.local&#8221;) and (CounterName == &#8220;ID Process&#8221;) and (ObjectName == &#8220;Process&#8221;)<br \/> | where InstanceName == &#8220;notepad&#8221;<br \/> | extend localTimestamp = TimeGenerated + 2h<br \/> | where TimeGenerated &gt; ago(5m) <br \/> | project TimeGenerated , CounterValue, InstanceName <br \/> | order by TimeGenerated  desc <\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image-2.png\" target=\"_blank\" rel=\"noreferrer noopener\"><img decoding=\"async\" loading=\"lazy\" width=\"624\" height=\"399\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image-2.png\" alt=\"\" class=\"wp-image-4528\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image-2.png 624w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2019\/05\/image-2-300x192.png 300w\" sizes=\"(max-width: 624px) 100vw, 624px\" \/><\/a><\/figure>\n\n\n\n<p><em>Disclaimer:\nCloud is a very fast-moving target. It means that by the time you\u00e2\u20ac\u2122re reading\nthis post everything described here could have been changed completely.<\/em><br \/>\n<em>Note that this is provided\n\u00e2\u20ac\u0153AS-IS\u00e2\u20ac\u009d with no warranties at all. This is not a production-ready solution for\nyour production environment, just an idea, and an example.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A common question when working with Azure Monitor is monitoring of Windows services and processes running on Windows servers. In Azure Monitor we can monitor Windows Services and other processes the same way; by looking at process ID as a performance counter. Even if a process can be monitored by looking at events, it is &hellip; <a href=\"http:\/\/contoso.se\/blog\/?p=4524\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":4525,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[64],"tags":[72,74,73],"_links":{"self":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4524"}],"collection":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4524"}],"version-history":[{"count":3,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4524\/revisions"}],"predecessor-version":[{"id":4530,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4524\/revisions\/4530"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/media\/4525"}],"wp:attachment":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4524"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}