Identifying CPU Spikes with Windows Server Data Collector Sets
Short answer
B Add Processor Information(_Total)\% Processor Time and Process(*)\% Processor Time to DataCollector1 to identify the specific process responsible for the CPU spike on VM1.
Question
Azure Monitor metrics show a recurring CPU spike on VM1. The existing metrics do NOT identify which process consumes CPU during the spike.
You plan to use a scheduled Data Collector Set named DataCollector1 to collect data during the spike window.
You need to identify the process responsible for the CPU spike.
Which counters should you add to DataCollector1?
Key Takeaways
The trap is choosing aggregate counters like Process(_Total) or non-consumption metrics like Thread Count; you must use Process(*)\% Processor Time to isolate individual process behavior.
Learn how to configure a Data Collector Set in Windows Server to pinpoint the exact process causing CPU spikes using performance counters. Correct answer: B.
Common mistake: Option C is incorrect because Process(_Total)\% Processor Time sums all process activity, making it impossible to distinguish which specific application is driving the CPU spike.
Expert Analysis
The objective is to isolate the specific process causing a CPU spike on an Azure VM. The tool specified is a Data Collector Set (DCS), which relies on Performance Monitor counters.
Option B is correct. To identify the culprit, you need two key pieces of information: confirmation that the system is under load and attribution of that load to individual processes. Processor Information(_Total)\% Processor Time confirms overall high utilization. Crucially, Process(*)\% Processor Time breaks down CPU usage by each running process instance. This allows you to see exactly which application is consuming resources during the spike window.
Why Option A fails. While Thread Count provides metadata about concurrency, it does not measure resource consumption. A process can have many threads but use little CPU, or few threads but consume 100% of a core. Without % Processor Time, you cannot determine which process is actually "heavy".
Why Option C fails. As noted in community feedback, Process(_Total) aggregates all processes into a single sum. This defeats the purpose of troubleshooting, as it hides the identity of the specific process causing the issue. You must use the wildcard (*) to enumerate individual processes.
Operational Consequence: Selecting the wrong counter type leads to "noise" data. If you collect thread counts or totals, you will have no visibility into the root cause, forcing manual investigation or inefficient sampling strategies later.
Adjacent Decision: If the goal were memory leaks instead of CPU spikes, you would switch to Process(*)\Working Set - Private rather than processor counters. Similarly, if you needed to monitor only the hypervisor host rather than the guest, you would need Host Resource metrics, not Guest OS process metrics.
Exam Strategy
When troubleshooting Windows Server performance issues via DCS, always look for counters that provide granularity. Avoid '_Total' aggregates when you need to identify a specific entity. Use wildcards (*) to expand lists of instances (like individual processes) and ensure the metric measures actual resource consumption (Time/Bytes) rather than just structural properties (Count/Threads).
Frequently Asked Questions
Why can't I use Process(_Total)\% Processor Time?
What is the difference between Processor Information and Process counters?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
linux_admin 👍 1 Answered BC is incorrect: Using Process(_Total)\% Processor Time aggregates the CPU time of all active processes into a single combined value. This prevents you from breaking down the metrics to see which individual process caused the problem.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-802 Questions
Access 125 questions with complete answers and detailed explanations.
View Full AZ-802 Practice Test →