Monitor a process with Azure Monitor

add Windows Performance Counters

Process(*)\ID Process

Perf

| where ObjectName == "Process"

and CounterName == "ID Process"

// | where CounterName contains "Processor Time"

| where Computer == "pc-vm-websrv1"

// | where Computer == "pc-vm-logicsrv2"

// | where Computer == "pc-vm-dbsrv3"

// | distinct InstanceName

| where InstanceName == "fdm" or InstanceName =="sakura" or InstanceName =="7zFM"

| summarize arg_max(TimeGenerated, *) by Computer, InstanceName

| project TimeGenerated, Computer, ProcessName = InstanceName

| order by TimeGenerated desc

A common question when working with Azure Monitor is monitoring of Windows services and processes running on Windows servers. In Azure Monitor we can monitor Windows Services and other processes the same way; by looking at process ID as a performance counter.

Even if a process can be monitored by looking at events, it is not always a reliable source. The challenge is that there is no “active monitoring” checking if the process is running at the moment when looking at only events.

Each process writes a number of performance counters. None of these are collected by default in Azure Monitor, but easy to add under Windows Performance Counters.