命令管理Commands management

.show 命令.show commands

.show commands 返回一个表,其中包含已达到最终状态的管理员命令。.show commands returns a table with admin commands that have reached a final state. 这些命令可供查询 30 天。These commands are available to query for 30 days.

命令表有两列,其中包含每个已完成命令的资源使用量详细信息。The commands table has two columns with resources consumption details of every completed command.

  • TotalCpu - 此命令使用的总 CPU 时钟时间(用户模式 + 内核模式)。TotalCpu - The total CPU clock time (User mode + Kernel mode) consumed by this command.
  • ResourceUtilization - 包含与该命令相关的所有资源使用信息(包括 TotalCpu)。ResourceUtilization - Contains all resource use information related to that command, including the TotalCpu.

所跟踪的资源使用量包括数据更新以及与当前的管理员命令关联的任何查询。Resource consumption that is tracked includes Data Updates, and any query associated with the current Admin command. 目前,命令表仅涵盖一些管理员命令(.ingest.set.append.set-or-replace.set-or-append)。Currently, only some of the admin commands are covered by the commands table (.ingest, .set, .append, .set-or-replace, .set-or-append). 我们会逐渐将更多命令添加到命令表中。Gradually, more commands will be added to the commands table.

语法Syntax

.show commands.show commands

示例Example

ClientActivityIdClientActivityId CommandTypeCommandType 文本Text 数据库Database StartedOnStartedOn LastUpdatedOnLastUpdatedOn 持续时间Duration 状态State RootActivityIdRootActivityId UserUser FailureReasonFailureReason 应用程序Application 主体Principal TotalCpuTotalCpu ResourceUtilizationResourceUtilization
KD2RunCommand;a069f9e3-6062-4a0e-aa82-75a1b5e16fb4KD2RunCommand;a069f9e3-6062-4a0e-aa82-75a1b5e16fb4 ExtentsMergeExtentsMerge .merge async Operations ....merge async Operations ... DB1DB1 2017-09-05 11:08:07.57385692017-09-05 11:08:07.5738569 2017-09-05 11:08:09.10511612017-09-05 11:08:09.1051161 00:00:01.531259200:00:01.5312592 已完成Completed b965d809-3f3e-4f44-bd2b-5e1f49ac46c5b965d809-3f3e-4f44-bd2b-5e1f49ac46c5 AAD app id=5ba8cec2-9a70-e92c98cad651AAD app id=5ba8cec2-9a70-e92c98cad651 Kusto.Azure.DM.SvcKusto.Azure.DM.Svc aadapp=5ba8cec2-9a70-e92c98cad651aadapp=5ba8cec2-9a70-e92c98cad651 00:00:03.578125000:00:03.5781250 { "ScannedExtentsStatistics": { "MinDataScannedTime": null, "MaxDataScannedTime": null }, "CacheStatistics": { Memory": { "Misses":2, "Hits":20 }, "Disk": { "Misses":2, "Hits":0 } }, "MemoryPeak":159620640, "TotalCpu":"00:00:03.5781250" }{ "ScannedExtentsStatistics": { "MinDataScannedTime": null, "MaxDataScannedTime": null }, "CacheStatistics": { Memory": { "Misses": 2, "Hits": 20 }, "Disk": { "Misses": 2, "Hits": 0 } }, "MemoryPeak": 159620640, "TotalCpu": "00:00:03.5781250" }
KE.RunCommand; 710e08ca-2cd3-4d2d-b7bd-2738d335aa50KE.RunCommand; 710e08ca-2cd3-4d2d-b7bd-2738d335aa50 DataIngestPullDataIngestPull .ingest into MyTableName ....ingest into MyTableName ... TestDBTestDB 2017-09-04 16:00:37.09154522017-09-04 16:00:37.0915452 2017-09-04 16:04:37.28345552017-09-04 16:04:37.2834555 00:04:00.191910300:04:00.1919103 已失败Failed a8986e9e-943f-81b0270d6fae4a8986e9e-943f-81b0270d6fae4 cooper@fabrikam.com 套接字连接已释放。The socket connection has been disposed. Kusto.ExplorerKusto.Explorer aaduser=...aaduser=... 00:00:0000:00:00 { "ScannedExtentsStatistics": { "MinDataScannedTime": null, "MaxDataScannedTime": null }, "CacheStatistics": { "Memory": { "Misses":0, Hits":0 }, "Disk": { "Misses":0, "Hits":0 } }, "MemoryPeak":0, "TotalCpu":"00:00:00"}{ "ScannedExtentsStatistics": { "MinDataScannedTime": null, "MaxDataScannedTime": null }, "CacheStatistics": { "Memory": { "Misses": 0, Hits": 0 }, "Disk": { "Misses": 0, "Hits": 0 } }, "MemoryPeak": 0, "TotalCpu": "00:00:00"}
KD2RunCommand;97db47e6-93e2-4306-8b7d-670f2c3307ffKD2RunCommand;97db47e6-93e2-4306-8b7d-670f2c3307ff ExtentsRebuildExtentsRebuild .merge async Operations ....merge async Operations ... DB2DB2 2017-09-18 13:29:38.59455312017-09-18 13:29:38.5945531 2017-09-18 13:29:39.94511632017-09-18 13:29:39.9451163 00:00:01.350563200:00:01.3505632 已完成Completed d5ebb755-d5df-4e94-b240-9accdf06c2d1d5ebb755-d5df-4e94-b240-9accdf06c2d1 AAD app id=5ba8cec2-9a70-e92c98cad651AAD app id=5ba8cec2-9a70-e92c98cad651 Kusto.Azure.DM.SvcKusto.Azure.DM.Svc aadapp=5ba8cec2-9a70-e92c98cad651aadapp=5ba8cec2-9a70-e92c98cad651 00:00:00.890625000:00:00.8906250 { "ScannedExtentsStatistics": { "MinDataScannedTime": null, "MaxDataScannedTime": null }, "CacheStatistics": { Memory": { "Misses":0, "Hits":1 }, "Disk": { "Misses":0, "Hits":0 } }, "MemoryPeak":88828560, "TotalCpu":"00:00:00.8906250"}{ "ScannedExtentsStatistics": { "MinDataScannedTime": null, "MaxDataScannedTime": null }, "CacheStatistics": { Memory": { "Misses": 0, "Hits": 1 }, "Disk": { "Misses": 0, "Hits": 0 } }, "MemoryPeak": 88828560, "TotalCpu": "00:00:00.8906250"}

示例:从 ResourceUtilization 列中提取特定数据Example: Extract specific data from the ResourceUtilization column

通过调用 ResourcesUtilization.xxx(其中的 xxx 是属性名称)来访问 ResourceUtilization 列中的属性之一。Accessing one of the properties within the ResourceUtilization column, is done by calling ResourcesUtilization.xxx (where xxx is the property name).

备注

ResourceUtilization 是动态列。ResourceUtilization is a dynamic column. 若要使用其值,应首先将其转换为特定的数据类型。To work with its values, you should first convert it into a specific data type. 使用转换函数,例如 tolongtointtotimespanUse a conversion function such as tolong, toint, totimespan.

例如,For example,

.show commands
| where CommandType == "TableAppend"
| where StartedOn > ago(1h)
| extend MemoryPeak = tolong(ResourcesUtilization.MemoryPeak)
| top 3 by MemoryPeak desc
| project StartedOn, MemoryPeak, TotalCpu, Text
StartedOnStartedOn MemoryPeakMemoryPeak TotalCpuTotalCpu 文本Text
2017-09-28 12:11:27.81553812017-09-28 12:11:27.8155381 800396032800396032 00:00:04.531250000:00:04.5312500 .append Server_Boots <| let bootStartsSourceTable = SessionStarts; ....append Server_Boots <| let bootStartsSourceTable = SessionStarts; ...
2017-09-28 11:21:26.73045472017-09-28 11:21:26.7304547 750063056750063056 00:00:03.821875000:00:03.8218750 .set-or-append WebUsage <| database('CuratedDB').WebUsage_v2.set-or-append WebUsage <| database('CuratedDB').WebUsage_v2 summarize ...summarize ... project ...project ...
2017-09-28 12:16:17.47625222017-09-28 12:16:17.4762522 676289120676289120 00:00:00.062500000:00:00.0625000 .set-or-append AtlasClusterEventStats with(...) <| Atlas_Temp(datetime(2017-09-28 12:13:28.7621737), datetime(2017-09-28 12:14:28.8168492)).set-or-append AtlasClusterEventStats with(...) <| Atlas_Temp(datetime(2017-09-28 12:13:28.7621737), datetime(2017-09-28 12:14:28.8168492))

调查性能问题Investigating performance issues

.show commands 可用于调查性能问题,因为这些命令会显示每个控制命令占用的资源。.show commands can be used to investigate performance issues, since they show you the resources consumed by each Control command.

以下示例是用于此类调查的简单而有用的查询。The following examples are simple and useful queries for such investigations.

查询 TotalCpu 列Query the TotalCpu column

在过去一天内消耗 CPU 最多的前 10 个查询。Top 10 CPU consuming queries in the last day.

.show commands
| where StartedOn > ago(1d)
| top 10 by TotalCpu
| project StartedOn, CommandType, ClientActivityId, TotalCpu

在过去 10 小时内 TotalCpu 超过 3 分钟的所有查询。All queries in the last 10 hours whose TotalCpu has passed 3 minutes.

.show commands
| where StartedOn > ago(10h) and TotalCpu > 3m
| project StartedOn, CommandType, ClientActivityId, TotalCpu
| order by TotalCpu

在过去 24 小时内 TotalCpu 超过 5 分钟的所有查询(按用户和主体分组)。All queries in the last 24 hours whose TotalCpu has passed 5 minutes, grouped by User and Principal.

.show commands
| where StartedOn > ago(24h)
| summarize TotalCount=count(), CountAboveThreshold=countif(TotalCpu > 2m), AverageCpu = avg(TotalCpu), MaxTotalCpu=max(TotalCpu), (50th_Percentile_TotalCpu, 95th_Percentile_TotalCpu)=percentiles(TotalCpu, 50, 95) by User, Principal
| extend PercentageAboveThreshold = strcat(substring(CountAboveThreshold * 100 / TotalCount, 0, 5), "%")
| order by CountAboveThreshold desc
| project User, Principal, CountAboveThreshold, TotalCount, PercentageAboveThreshold, MaxTotalCpu, AverageCpu, 50th_Percentile_TotalCpu, 95th_Percentile_TotalCpu

时间表:平均 CPU 与第 95 个百分点值与最大 CPU。Timechart: Average CPU vs 95th Percentile vs Max CPU.

.show commands
| where StartedOn > ago(1d)
| summarize MaxCpu_Minutes=max(TotalCpu)/1m, 95th_Percentile_TotalCpu_Minutes=percentile(TotalCpu, 95)/1m, AverageCpu_Minutes=avg(TotalCpu)/1m by bin(StartedOn, 1m)
| render timechart

查询 MemoryPeakQuery the MemoryPeak

在过去一天内 MemoryPeak 值最高的前 10 个查询。Top 10 queries in the last day with the highest MemoryPeak values.

.show commands
| where StartedOn > ago(1d)
| extend MemoryPeak = tolong(ResourcesUtilization.MemoryPeak)
| project StartedOn, CommandType, ClientActivityId, TotalCpu, MemoryPeak
| top 10 by MemoryPeak

平均 MemoryPeak 与第 95 个百分点值与最大 MemoryPeak 的时间表。Timechart of Average MemoryPeak vs 95th Percentile vs Max MemoryPeak.

.show commands
| where StartedOn > ago(1d)
| project MemoryPeak = tolong(ResourcesUtilization.MemoryPeak), StartedOn
| summarize Max_MemoryPeak=max(MemoryPeak), 95th_Percentile_MemoryPeak=percentile(MemoryPeak, 95), Average_MemoryPeak=avg(MemoryPeak) by bin(StartedOn, 1m)
| render timechart