Visualizing the trend of performance counters in Log Analytics using Linear Regression

It’s easy to visualize performance information in Log Analytics, but how can you create indicate the trend of these counters? This blog post will showcase how the Linear Regression functionality can be used in Log Analytics to provide a trend line as one example for this functionality.

This blog post will show:

How Server performance information is displayed in a dashboard
How to create a trend line for processor utilization for a single system
How to create a trend line for processor utilization for a group of systems

Server Performance Dashboards

In the Server Performance dashboards for Log Analytics we can easily see the KPI’s for your various servers in a single view. This includes processor utilization as an example.

In the solution you can drill down to see a second level chart which shows all of the computers stacked for their usage. You can also create a simple query which would show processor usage for a specific system like the one below.

Perf

| where (ObjectName == “Processor” or ObjectName == “System”) and CounterName == “% Processor Time” and Computer == “<Computername>”

| summarize AggregatedValue = percentile(CounterValue, 90) by bin(TimeGenerated, 1h), Computer

| sort by TimeGenerated desc

| render timechart

Below is a slightly more complex version of this query is below where we can establish variables for the object, counter, start date, end date, and computer name.

let Object = “Processor”;

let Counter = “% Processor Time”;

let StartDate = now(-160d);

let EndDate = now();

let Comp = “<Computername>”;

Perf

| where TimeGenerated between (StartDate..EndDate) and (ObjectName == Object) and CounterName == Counter and Computer == Comp

| project CounterValue, TimeGenerated

| sort by TimeGenerated asc

| render timechart

A sample output for a system is shown below.

Creating a trend line for processor utilization

But what if we to know the trend for this counter? We can take the query above and extend them with some very cool features in Log Analytics. In this case we are going to use Linear Regression to create a trend line. We take the original query and add the make-series capability combined with a series_fit_line to accomplish this change.

let Object = “Processor”;

let Counter = “% Processor Time”;

let StartDate = now(-160d);

let EndDate = now();

let Comp = “<Computername>”;

Perf

| where TimeGenerated between (StartDate..EndDate) and (ObjectName == Object) and CounterName == Counter and Computer == Comp

| make-series PerfCounter = avg(CounterValue) on TimeGenerated in range(StartDate,EndDate, 1d)

| extend (RSquare,Slope,Variance,RVariance,Interception,TrendLine)=series_fit_line(PerfCounter)

| render timechart

The results is below, % Processor Time for a system – with a trend line added! The first one shows a short timeframe (a couple of weeks for one system) where the trend line is decreasing.

The second one shows a longer duration for the same counter where the trend line is slowly increasing.

Creating a trend line for free disk space

The query in this blog post is designed to be able to be used with any performance counter collected by Log Analytics by just changing the variables. The following an example showing free disk space over time. The only change is to alter the values for Object and Counter.

let Object = “LogicalDisk“;

let Counter = “% Free Space“;

let StartDate = now(-160d);

let EndDate = now();

let Comp = “<Computername>”;

Perf

| where TimeGenerated between (StartDate..EndDate) and (ObjectName == Object) and CounterName == Counter and Computer == Comp

| make-series PerfCounter = avg(CounterValue) on TimeGenerated in range(StartDate,EndDate, 1d)

| extend (RSquare,Slope,Variance,RVariance,Interception,TrendLine)=series_fit_line(PerfCounter)

| render timechart

Here’s the trend line for logical disk free space.

Creating a trend line for processor utilization for multiple systems

A trend line can also be created for multiple computer systems. The example below shows overall processor utilization trends.

let Object = “Processor”;

let Counter = “% Processor Time”;

let StartDate = now(-7d);

let EndDate = now();

Perf

| where ObjectName == Object and CounterName == Counter

| summarize AvgCounter = avg(CounterValue) by bin(TimeGenerated, 1h), CounterName

| make-series PerfCounter = avg(AvgCounter) on TimeGenerated in range(StartDate,EndDate, 1d)

| extend (RSquare,Slope,Variance,RVariance,Interception,TrendLine)=series_fit_line(PerfCounter)

| render timechart

Summary: Providing a trend line for your data is pretty easy once you know the trick (or just use my sample). Thank you to Brian Wren who pointed me to this functionality!