Examkin

Question

Difficulty: Very hardLog Analytics Workspaces and KQL Queries

You have an Azure subscription. You deploy the Azure Monitor agent to 2020 virtual machines that run Windows Server. All performance counters are collected and sent to a Log Analytics workspace named Workspace1.

Workspace1 is configured with the default data retention period of 3030 days.

You need to analyze the average CPU utilization for the virtual machines over the last 4545 days. The results must show only computers with an average CPU utilization greater than 90%90\% and be sorted from the highest utilization to the lowest.

Which action and query should you select to meet these requirements?

  1. A
    Change the data retention of Workspace1 to 4545 days, and run the following query:

    kql
    Perf
    | where TimeGenerated > ago(45d) and ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
    | where AvgCPU > 90
    | summarize AvgCPU = avg(CounterValue) by Computer
    | sort by AvgCPU desc
  2. Change the data retention of Workspace1 to 4545 days, and run the following query:

    kql
    Perf
    | where TimeGenerated > ago(45d)
    | where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
    | summarize AvgCPU = avg(CounterValue) by Computer
    | where AvgCPU > 90
    | sort by AvgCPU desc
    Answer
  3. C
    Keep the default data retention of Workspace1, and run the following query:

    kql
    Perf
    | where TimeGenerated > ago(45d)
    | where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
    | summarize AvgCPU = avg(CounterValue) by Computer
    | where AvgCPU > 90
    | sort by AvgCPU desc
  4. D
    Change the data retention of Workspace1 to 4545 days, and run the following query:

    kql
    Perf
    | where TimeGenerated > ago(45d)
    | where ObjectName = "Processor" and CounterName = "% Processor Time" and InstanceName = "_Total"
    | summarize AvgCPU = avg(CounterValue) by Computer
    | where AvgCPU > 90
    | order by AvgCPU desc

Answer

Change the data retention of Workspace1 to 4545 days, and use the query that places the aggregation filter after the summarize operator and uses double equals for comparisons.
The correct answer combines increasing the data retention to 4545 days with a syntactically correct KQL query. The query uses double equals (`==`) for comparisons, correctly aggregates the CPU counters by computer, and applies the `AvgCPU` threshold filter after the column has been created by the `summarize` operator.

Step-by-Step Solution

1
Evaluate workspace retention constraints.
Since the default retention is 3030 days, performance metrics from 3131 to 4545 days ago would be permanently deleted. Changing the retention of Workspace1 to 4545 days ensures the historical logs are stored.
You cannot query log data that has already been purged due to retention policies.
2
Filter source events in KQL.
Filter by `TimeGenerated > ago(45d)` and identify the CPU utilization counters using `ObjectName == "Processor"`, `CounterName == "% Processor Time"`, and `InstanceName == "_Total"`.
Filtering should occur early in the query sequence to reduce the dataset size for subsequent operations.
3
Aggregate performance counters using summarize.
Construct the operator: `| summarize AvgCPU = avg(CounterValue) by Computer`.
This aggregates the counter values by the host computer name and defines the calculated column `AvgCPU`.
4
Filter and sort the aggregated results.
Apply `| where AvgCPU > 90` followed by `| sort by AvgCPU desc`.
You can only filter and sort by `AvgCPU` after the variable is defined in the pipeline sequence. KQL queries compile and execute sequentially.

Key Concept

Log Analytics workspace data retention limitations and formulating syntactically correct KQL queries utilizing proper operator order and comparison operators.
Estimated Time:3m 0s
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic