Detect Processes That Are Reading Or Writing Significantly To Disk
Query
// Use Case: Monitoring and identifying high disk I/O activity for processes exceeding 10 MB in either read or write operations to optimize resource usage.
Process
| where DiskBytesRead > 10000000 or DiskBytesWritten > 10000000
| project ProcessId, ProcessName, Path, DiskBytesReadMB = DiskBytesRead / 1048576, DiskBytesWrittenMB = DiskBytesWritten / 1048576
| order by DiskBytesWrittenMB descExplanation
This query is designed to monitor and identify processes on a system that are using a lot of disk input/output (I/O) resources. Specifically, it looks for processes that have read from or written to the disk more than 10 megabytes (MB). Here's a simple breakdown of what the query does:
-
Filter Processes: It selects processes where either the amount of data read from the disk or the amount of data written to the disk is greater than 10 MB.
-
Select Information: For these processes, it retrieves and displays the following details:
ProcessId: The unique identifier for the process.ProcessName: The name of the process.Path: The file path of the process.DiskBytesReadMB: The amount of data read from the disk, converted to megabytes.DiskBytesWrittenMB: The amount of data written to the disk, converted to megabytes.
-
Order Results: It sorts the results in descending order based on the amount of data written to the disk (in MB).
This helps in identifying which processes are using the most disk resources, allowing for optimization of resource usage.
Details
Ugur Koc
Released: December 13, 2024
Tables
Keywords
Operators