Gitesh PortfolioAlways On

In this blog , you will find a Azure logs query that can help you to find CPU usage of each pods in Azure Kubernetes Service (AKS).

// List all the pods count with phase 
// View pod phase counts based on all phases: Failed, Pending, Unknown, Running, or Succeeded. 
// To create an alert for this query, click '+ New alert rule'
//Customize endDateTime, startDateTime to select different time range
   let endDateTime = datetime(2021-04-07 01:00:00);
    let startDateTime = datetime(2021-04-07 00:00:00);
    let trendBinSize = 1m;
    KubePodInventory
    | where TimeGenerated < endDateTime
    | where TimeGenerated >= startDateTime
    | where PodLabel contains "cd-blue"
    | distinct ClusterName, TimeGenerated, _ResourceId
    | summarize ClusterSnapshotCount = count() by bin(TimeGenerated, trendBinSize), ClusterName, _ResourceId
    | join hint.strategy=broadcast (
        KubePodInventory
        | where TimeGenerated < endDateTime
        | where TimeGenerated >= startDateTime
        | where PodLabel contains "cd-blue"
        | distinct ClusterName, Computer, PodUid, TimeGenerated, PodStatus, _ResourceId
        | summarize TotalCount = count(), //Calculating count for per pod status
                    PendingCount = sumif(1, PodStatus =~ 'Pending'),
                    RunningCount = sumif(1, PodStatus =~ 'Running'),
                    SucceededCount = sumif(1, PodStatus =~ 'Succeeded'),
                    FailedCount = sumif(1, PodStatus =~ 'Failed')
                 by ClusterName, bin(TimeGenerated, trendBinSize), _ResourceId
    ) on ClusterName, TimeGenerated, _ResourceId
    | extend UnknownCount = TotalCount - PendingCount - RunningCount - SucceededCount - FailedCount
    | project TimeGenerated, _ResourceId,
    TotalCount = todouble(TotalCount) / ClusterSnapshotCount,
              PendingCount = todouble(PendingCount) / ClusterSnapshotCount,
              RunningCount = todouble(RunningCount) / ClusterSnapshotCount,
              SucceededCount = todouble(SucceededCount) / ClusterSnapshotCount,
              FailedCount = todouble(FailedCount) / ClusterSnapshotCount,
              UnknownCount = todouble(UnknownCount) / ClusterSnapshotCount