Today I was looking at Perfmon data for a particular process. In this case it happened to be lsass.exe but only on Domain Controllers.
I needed to add this Perfmon Counter to OMS, in Settings - Data - Windows Performance Counters (via the OMS portal not the Azure portal)
I added the counter called:
I also set the Sample Interval to 300 seconds rather than the default 10secs...now is a good time for a coffee/tea to allow the data to start to flow.
After my coffee break, I dis a quick check to see if lsass was being captured, in the Advanced Analytics portal I typed:
Perf
| search "lsass"
When the data appeared, I amended the query to just show the info from computers that start with DCnnnn (which is true in my environment, edit to suit), I also filtered on ObjectName and InstanceName to be more precise on where I picked the string lsass up from
Perf
| where TimeGenerated > ago(1d)
| where ObjectName == "Process" and InstanceName == "lsass" and Computer startswith "DC"
In the end I wanted to make sure I could see each computer separately on a Line Chart and also restrict the data to One day (always good practise not to pull too much data) and to show in 5minute intervals
Perf
| where TimeGenerated > ago(1d)
| where ObjectName == "Process" and InstanceName == "lsass" and Computer startswith "DC"
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5min)
| render timechart
