{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/", "slug": "dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator", "url": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/" }, "title": "Keep VM watch process CPU percentages tied to their denominator", "summary": "Why can two VM watch process CPU metrics report different percentages for the same process?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:28+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 233, "potentially_affected": "Azure VMs and scale sets evaluating the VM watch preview's process CPU measurements.", "dse_recommendation": "Label process CPU charts with the exact VM watch metric and denominator.", "primary_source": { "name": "Azure VM Watch - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/azure-vm-watch", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

VM watch is a preview that runs configurable in-guest health checks and is delivered through the Application Health VM extension. Its ProcessCPUCoreUsage metric expresses instantaneous process usage against one CPU core, whereas ProcessCPUMachineUsage expresses process usage against the machine’s total CPU. MachineTotalCpuUsage describes the VM’s total instantaneous CPU utilization. Microsoft Learn.

\n

Applicability

\n

Use this interpretation check when building process-level dashboards or comparing a process chart with a whole-machine chart. Preserve the metric names in the evidence instead of presenting every percentage under a generic CPU heading.

\n

DSE recommendation

\n

Label process CPU charts with the exact VM watch metric and denominator. Have the monitoring owner explain which question each chart answers: how much of one core the process is consuming, how much of the machine it is consuming, or how busy the entire VM is. Review any proposed alert threshold against that selected measurement. Do not transfer a threshold merely because both charts use a percent sign.

\n

Verification

\n

Collect the relevant signals over the same controlled workload interval and inspect them together. Record the VM configuration and the exact measurement being reviewed. If a chart differs from expectations, check its selected metric before diagnosing a workload regression. Treat this as a preview evaluation, and verify the actual deployed collector configuration rather than assuming every default signal is present.

\n

Official references

\n

Microsoft Learn: VM watch: Enhancing VM health monitoring preview. Source reviewed September 9, 2026.

", "content_text": "Source facts\nVM watch is a preview that runs configurable in-guest health checks and is delivered through the Application Health VM extension. Its ProcessCPUCoreUsage metric expresses instantaneous process usage against one CPU core, whereas ProcessCPUMachineUsage expresses process usage against the machine’s total CPU. MachineTotalCpuUsage describes the VM’s total instantaneous CPU utilization. Microsoft Learn.\nApplicability\nUse this interpretation check when building process-level dashboards or comparing a process chart with a whole-machine chart. Preserve the metric names in the evidence instead of presenting every percentage under a generic CPU heading.\nDSE recommendation\nLabel process CPU charts with the exact VM watch metric and denominator. Have the monitoring owner explain which question each chart answers: how much of one core the process is consuming, how much of the machine it is consuming, or how busy the entire VM is. Review any proposed alert threshold against that selected measurement. Do not transfer a threshold merely because both charts use a percent sign.\nVerification\nCollect the relevant signals over the same controlled workload interval and inspect them together. Record the VM configuration and the exact measurement being reviewed. If a chart differs from expectations, check its selected metric before diagnosing a workload regression. Treat this as a preview evaluation, and verify the actual deployed collector configuration rather than assuming every default signal is present.\nOfficial references\nMicrosoft Learn: VM watch: Enhancing VM health monitoring preview. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nVM watch is a preview that runs configurable in-guest health checks and is delivered through the Application Health VM extension. Its ProcessCPUCoreUsage metric expresses instantaneous process usage against one CPU core, whereas ProcessCPUMachineUsage expresses process usage against the machine’s total CPU. MachineTotalCpuUsage describes the VM’s total instantaneous CPU utilization. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/azure-vm-watch).\n\n## Applicability\n\nUse this interpretation check when building process-level dashboards or comparing a process chart with a whole-machine chart. Preserve the metric names in the evidence instead of presenting every percentage under a generic CPU heading.\n\n## DSE recommendation\n\nLabel process CPU charts with the exact VM watch metric and denominator. Have the monitoring owner explain which question each chart answers: how much of one core the process is consuming, how much of the machine it is consuming, or how busy the entire VM is. Review any proposed alert threshold against that selected measurement. Do not transfer a threshold merely because both charts use a percent sign.\n\n## Verification\n\nCollect the relevant signals over the same controlled workload interval and inspect them together. Record the VM configuration and the exact measurement being reviewed. If a chart differs from expectations, check its selected metric before diagnosing a workload regression. Treat this as a preview evaluation, and verify the actual deployed collector configuration rather than assuming every default signal is present.\n\n## Official references\n\n[Microsoft Learn: VM watch: Enhancing VM health monitoring preview](https://learn.microsoft.com/en-us/azure/virtual-machines/azure-vm-watch). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/", "url": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep VM watch process CPU percentages tied to their denominator", "item": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/", "url": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/", "headline": "Keep VM watch process CPU percentages tied to their denominator", "description": "Why can two VM watch process CPU metrics report different percentages for the same process?", "abstract": "Why can two VM watch process CPU metrics report different percentages for the same process?", "articleBody": "Source facts\nVM watch is a preview that runs configurable in-guest health checks and is delivered through the Application Health VM extension. Its ProcessCPUCoreUsage metric expresses instantaneous process usage against one CPU core, whereas ProcessCPUMachineUsage expresses process usage against the machine’s total CPU. MachineTotalCpuUsage describes the VM’s total instantaneous CPU utilization. Microsoft Learn.\nApplicability\nUse this interpretation check when building process-level dashboards or comparing a process chart with a whole-machine chart. Preserve the metric names in the evidence instead of presenting every percentage under a generic CPU heading.\nDSE recommendation\nLabel process CPU charts with the exact VM watch metric and denominator. Have the monitoring owner explain which question each chart answers: how much of one core the process is consuming, how much of the machine it is consuming, or how busy the entire VM is. Review any proposed alert threshold against that selected measurement. Do not transfer a threshold merely because both charts use a percent sign.\nVerification\nCollect the relevant signals over the same controlled workload interval and inspect them together. Record the VM configuration and the exact measurement being reviewed. If a chart differs from expectations, check its selected metric before diagnosing a workload regression. Treat this as a preview evaluation, and verify the actual deployed collector configuration rather than assuming every default signal is present.\nOfficial references\nMicrosoft Learn: VM watch: Enhancing VM health monitoring preview. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:28+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-028-keep-vm-watch-process-cpu-percentages-tied-to-their-denominator/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep VM watch process CPU percentages tied to their denominator" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure VM Watch - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/azure-vm-watch" } } ] } }