Filter OMS near real-time performance counter data by computer

Summary: Learn how to use Log Search in Microsoft Operations Management Suite to filter near real-time performance counter data by computer name.

Good morning everyone, Ed Wilson here. One of the cool things about central Florida is the abundance of natural resources, and the outdoor lifestyle we enjoy. For example, the Scripting Wife and I recently went to see manatees. These dudes are awesome and mellow, and they are way cool marine mammals. They are also, unfortunately, endangered, so we are really lucky to get to see them hanging out and relaxing. Here is a picture of one that we saw.

Photo of manatee

Sort performance data by computer name

  Note  This  is a five-part series that includes the following posts:

The first things I want to know are:

  • The computer names
  • How many records they may provide for me to examine

The first thing I do is to go into Log Search. I find Log Search directly from the Start screen on my MS OMS console.

Image of menu

I find the computer name information easily by using Type=Perf and then filtering the records by computer. I get my counts because Computer is the property that I want to measure. Here is my query:

Type=Perf | measure count() by Computer

Here is my query and the results on my system:

Image of menu

So, now that I have a list of computer names and the number of records that each computer has, I can add a filter for the specific computer that I am interested in querying. To do this I simply add computer = “mycomputername” to the query. Here is a query that works on my system where I look at AzureDev01:

Type=Perf Computer=AzureDev01

I can see from the query results that there are 136,848 records and that they cover 200 metrics. Here is the query and the output from the query:

Image of menu

When I switch to metric view, I can see the metrics as graphs, and I could dive in to them if I want.

Note  I discussed this approach yesterday in Use OMS Search to visualize collected performance data.

The metric view page is shown here:

Image of menu

Dive in to a specific counter in a specific group

Now that I have found performance counters for a specific computer, I can dive in a bit more. For example, I can look at performance counters related to memory. To do this, I add ObjectName=Memory. This will return a group of performance counters that are related to memory. I also want them only related to a specific computer, so I leave my computer filter in the query. Here is my revised search:

Type=Perf Computer=AzureDev01 ObjectName=Memory

Here are the query and the associated output, where I have opened the Committed Bytes in Use:

Image of menu

If I want to look at a specific counter on a specific computer, I add a filter for the counter, for example:

Type=Perf Computer=AzureDev01 ObjectName=Memory CounterName="% Committed Bytes In Use"

Image of menu

That is all I have for you today. Join me tomorrow when I’ll talk about more way cool stuff.

I invite you to follow me on Twitter and the Microsoft OMS Facebook site. If you want to learn more about Windows PowerShell, visit the Hey, Scripting Guy! Blog. If you have any questions, send email to me at I wish you a wonderful day, and I’ll see you tomorrow.

Ed Wilson
Microsoft Operations Management Team