Microsoft Azure – VM CPU Utilisation Across Subscriptions with Range

Here, In this article, we will be finding the Azure Virtual Machines across azure subscriptions where Average CPU Utilization in range and displaying only the results of only top utilized or underutilized VMs across subscriptions in descending order or in ascending order.

By using the below KQL Queries you can fetch the azure data source results by using Azure Monitor Logs. Run the below query either in Azure Monitor Logs or Log Analytics Workspace or Azure Workbooks to get the results.

Note: Before executing the replace the Subscription Id’s and  Subscription Name’s with your active Azure Subscription Id’s and Subscription Name’s.

1 . Top VMs where Average CPU Utilization Ranges between  (Value .. Value) in descending order:

KQL Log Query:

Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" 
and InstanceName == "_Total"
//Replace Subscription Id values with our Azure Subscription Ids
//You can add or remove additions according to your requirement
| where _SubscriptionId == "68xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 1
_SubscriptionId == "61xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 2
_SubscriptionId == "74xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 3
_SubscriptionId == "6cxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 4
_SubscriptionId == "acxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" //Subscription 5
//Replace your Subscription Id's and Subscription Names 
//You can add or remove additions according to your requirement
| extend AzureSubscriptionName =case(
_SubscriptionId =~ '68xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 1', 
_SubscriptionId =~ '61xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 2', 
_SubscriptionId =~ '74xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 3',
_SubscriptionId =~ '6cxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 4',
_SubscriptionId =~ 'axxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 5', 
_SubscriptionId)
| summarize AVG_CPU = round(avg(CounterValue), 3) by bin(TimeGenerated, 30d), Computer, AzureSubscriptionName
| where AVG_CPU between ( 15 .. 50 )
| top 10 by AVG_CPU desc

This query will return the top 10 Azure Virtual Machines where Average CPU Utilization ranges between 15 to 50 in descending order with Table Time Generated, Azure VM Name, and Azure Subscription Name.

Output:

2. Top VMs where Maximum CPU Utilization Ranges between  (Value .. Value) in descending order:

KQL Log Query:

Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" 
and InstanceName == "_Total"
//Replace Subscription Id values with our Azure Subscription Ids
//You can add or remove additions according to your requirement
| where _SubscriptionId == "68xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 1
_SubscriptionId == "61xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 2
_SubscriptionId == "74xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 3
_SubscriptionId == "6cxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 4
_SubscriptionId == "acxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" //Subscription 5
//Replace your Subscription Id's and Subscription Names 
//You can add or remove additions according to your requirement
| extend AzureSubscriptionName =case(
_SubscriptionId =~ '68xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 1', 
_SubscriptionId =~ '61xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 2', 
_SubscriptionId =~ '74xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 3',
_SubscriptionId =~ '6cxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 4',
_SubscriptionId =~ 'axxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 5', 
_SubscriptionId)
| summarize MAX_CPU = round(max(CounterValue), 3) by bin(TimeGenerated, 30d), Computer, AzureSubscriptionName
| where MAX_CPU between ( 50 .. 99)
| top 10 by MAX_CPU desc

This query will return the top 10 Azure Virtual Machines where Maximum CPU Utilization ranges between 50 to 100 in descending order with Table Time Generated, Azure VM Name, and Azure Subscription Name.

Output:

3. Top VMs where Maximum CPU Utilization Ranges between  (Value .. Value) in ascending order:

KQL Log Query:

Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" 
and InstanceName == "_Total"
//Replace Subscription Id values with our Azure Subscription Ids
//You can add or remove additions according to your requirement
| where _SubscriptionId == "68xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 1
_SubscriptionId == "61xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 2
_SubscriptionId == "74xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 3
_SubscriptionId == "6cxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or //Subscription 4
_SubscriptionId == "acxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" //Subscription 5
//Replace your Subscription Id's and Subscription Names 
//You can add or remove additions according to your requirement
| extend AzureSubscriptionName =case(
_SubscriptionId =~ '68xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 1', 
_SubscriptionId =~ '61xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 2', 
_SubscriptionId =~ '74xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 3',
_SubscriptionId =~ '6cxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 4',
_SubscriptionId =~ 'axxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'Subscription 5', 
_SubscriptionId)
| summarize MIN_CPU = round(min(CounterValue), 3) by bin(TimeGenerated, 30d), Computer, AzureSubscriptionName
| where MIN_CPU between ( 10 .. 20)
| top 10 by MIN_CPU asc

This query will return the top 10 Azure Virtual Machines where Minimum CPU Utilization ranges between 10 to 20 in ascending order with Table Time Generated, Azure VM Name, and Azure Subscription Name.

Output:

Note: Try with your own Subscriptions Names and Ids.