General troubleshooting/notes

Get pod names running in a replica set at a given time

let start = todatetime('2023-11-07T04:00:00Z');
let end = todatetime('2023-11-07T05:00:00Z');
let nameprefix = "pod name prefix"
KubePodInventory
| where TimeGenerated between (start .. end)
| where Name startswith nameprefix
| distinct Name

Get node names running during a given time duration:

let start = todatetime('2023-11-07T04:00:00Z');
let end = todatetime('2023-11-07T05:00:00Z');
let nameprefix = "aksnpwin8"
KubeNodeInventory
| where TimeGenerated between (start .. end)
| where Computer startswith nameprefix

Get CPU Utilization Avg Per Microservice

let _ResourceLimitCounterName = 'cpuLimitNanoCores';
let _ResourceUsageCounterName = 'cpuUsageNanoCores';
KubePodInventory
| where Namespace in ('dam-c000', 'pm-r01')
| extend
    InstanceName = strcat(ClusterId, '/', ContainerName),
    ContainerName = strcat(ControllerName, '/', tostring(split(ContainerName, '/')[1]))
| distinct Computer, InstanceName
| join kind=inner hint.strategy=shuffle (
    Perf
    | where ObjectName == 'K8SContainer' and CounterName == _ResourceLimitCounterName
    | summarize MaxLimitValue = max(CounterValue) by Computer, InstanceName, bin(TimeGenerated, _BinSize)
    | project
        Computer,
        InstanceName,
        MaxLimitValue
    )
    on Computer, InstanceName
| join kind=inner hint.strategy=shuffle (
    Perf
    | where ObjectName == 'K8SContainer' and CounterName == _ResourceUsageCounterName
    | project Computer, InstanceName, UsageValue = CounterValue, TimeGenerated
    )
    on Computer, InstanceName
| project
    ContainerName = tostring(split(InstanceName, '/')[10]),
    Computer,
    TimeGenerated,
    UsagePercent = UsageValue * 100.0 / MaxLimitValue
| summarize AvgCPUUsagePercentage = avg(UsagePercent) by bin(TimeGenerated, 1h), ContainerName
| render timechart;

Get Memory Utilization Avg per Microservice

let _ResourceLimitCounterName = 'memoryLimitBytes';
let _ResourceUsageCounterName = 'memoryWorkingSetBytes';
KubePodInventory
| where Namespace in ('dam-c000', 'pm-r01')
| extend InstanceName = strcat(ClusterId, '/', ContainerName),
    ContainerName = strcat(ControllerName, '/', tostring(split(ContainerName, '/')[1]))
| distinct Computer, InstanceName, ContainerName
| join kind=inner hint.strategy=shuffle (
    Perf
    | where ObjectName == 'K8SContainer' and CounterName == _ResourceLimitCounterName
    | summarize MaxLimitValue = max(CounterValue) by Computer, InstanceName, bin(TimeGenerated, 1h)
    | project
        Computer,
        InstanceName,
        MaxLimitValue
    )
    on Computer, InstanceName
| join kind=inner hint.strategy=shuffle (
    Perf
    | where ObjectName == 'K8SContainer' and CounterName == _ResourceUsageCounterName
    | project Computer, InstanceName, UsageValue = CounterValue, TimeGenerated
    )
    on Computer, InstanceName
| project
    AppName = tostring(split(InstanceName, '/')[10]),
    Computer,
    TimeGenerated,
    UsagePercent = UsageValue * 100.0 / MaxLimitValue
| summarize MemoryUsagePercentage = avg(UsagePercent) by bin(TimeGenerated, 1h), AppName
| render timechart;