Skip to content
Telemetry
Infrastructure SQL recipe

Find host and container resource saturation

Rank infrastructure sources by sustained CPU, memory, and disk utilization while preserving sample volume.

Beginnersystem_metricsReviewed 2026-07-28Tested with Apache DataFusion 45.2.0

Reviewed by the Telemetry product team on . We checked the SQL syntax, required event fields, sample results, and limits on using the query. Who reviews this page

Question answered

Which infrastructure sources are persistently resource constrained?

A single utilization spike is often noise. Hourly averages and maximums show whether a host or container stayed saturated long enough to affect application work.

Event schema

Fields the query expects

FieldTypeWhy it exists
timestamp_utcTimestampMetric sample time in UTC.
sourceUtf8Stable host, service, or container identifier.
environmentUtf8Deployment environment.
cpu_utilization_pctFloat64CPU utilization from 0 to 100.
memory_utilization_pctFloat64Memory utilization from 0 to 100.
disk_utilization_pctFloat64Disk utilization from 0 to 100.
DataFusion SQL

Copy the query

sql
SELECT
  date_trunc('hour', timestamp_utc) AS hour,
  source,
  COUNT(*) AS samples,
  AVG(cpu_utilization_pct) AS average_cpu_pct,
  MAX(cpu_utilization_pct) AS maximum_cpu_pct,
  AVG(memory_utilization_pct) AS average_memory_pct,
  MAX(memory_utilization_pct) AS maximum_memory_pct,
  MAX(disk_utilization_pct) AS maximum_disk_pct
FROM system_metrics
WHERE timestamp_utc >= now() - INTERVAL '24 hours'
  AND environment = 'production'
GROUP BY date_trunc('hour', timestamp_utc), source
HAVING COUNT(*) >= 6
  AND (
    AVG(cpu_utilization_pct) >= 80.0
    OR AVG(memory_utilization_pct) >= 85.0
    OR MAX(disk_utilization_pct) >= 90.0
  )
ORDER BY average_cpu_pct DESC, average_memory_pct DESC;

This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. We review the synthetic sample output separately. Check field types, thresholds, and counting rules against your own data. Read the testing methodology.

Query result

Average CPU utilization for saturated sources

The import worker is CPU constrained, while the API source entered the result because of sustained memory pressure.

hoursourcesamplesaverage_cpu_pctmaximum_cpu_pctaverage_memory_pctmaximum_memory_pctmaximum_disk_pct
2026-07-27 14:00worker-imports-036091.499.278.884.166.2
2026-07-27 14:00api-primary-026062.188.489.393.672.5

Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.

Average CPU utilization for saturated sources: static chart of synthetic average_cpu_pct values from the Find host and container resource saturation example result
Download this SVG chart of the sample results for an article, runbook, or design review. Please credit Telemetry.

Reproduce the example

Download the sample data

The JSON bundle includes the event schema with field types, illustrative input rows, exact SQL, expected output, review notes, and engine version. The CSV contains the displayed result.

How the SQL works

  1. 1Hourly grouping reduces individual-sample noise while keeping the affected time window visible.
  2. 2Average CPU and memory show sustained pressure. Use maximum disk utilization to catch a full disk that an average could hide.
  3. 3A sample minimum prevents a partially reporting source from appearing healthy or saturated based on too little data.

Edge cases to check

  • Container CPU percentages can exceed 100 when the source reports utilization across several cores; normalize the contract first.
  • Memory pressure depends on reclaimable cache and workload behavior, not only a universal percentage.
  • Missing samples require a separate heartbeat or ingestion-freshness view.

Recommended dashboard

  • Bars: average CPU and memory by source
  • Trend: maximum disk utilization
  • Table: saturated sources with sample count and owning service

Alert guidance

Alert only when sustained utilization and a user-facing symptom such as latency, queue age, or errors breach their objectives together.

Read alert setup

Set up the events this query needs

Related instrumentation and guides

Continue the analysis

Run it on your events

Create a table, adapt the fields, and save the result

Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.

Get an API key