The method of using Azure Monitor to monitor Process in Windows system

In common monitoring scenarios, in addition to monitoring server performance and service health, we also need to monitor the health of certain processes. In Azure Monitor, we can treat process IDs as performance counters to monitor process health.

Each process writes a number of values to the performance counters. Azure Monitor does not collect these values by default, but we can easily see them in Windows Performance:

Configure collection process data

We can configure Azure Monitor to monitor processes as performance counters, using notepad as an example:

In the Log Analytics workspace, click "Advanced settings"--"Data"--"Windows Performance Counters" and add "Process[notepad]\ID Process":

View collected data

Once configured, we can query notepad's process ID using the following query: If the Notepad program is not running, there is no data. If Alert needs to be set, alert rules can be configured to generate alerts when zero results are returned within the last X minutes.

Perf| where InstanceName == "notepad"| extend localTimestamp = TimeGenerated + 8h| where TimeGenerated > ago(5m)| project TimeGenerated , CounterValue, InstanceName| order by TimeGenerated desc