Monitor CPU on a rogue w3wp.exe IIS process

[robatwork]

Hi,
I'm just getting going with Nagios so a huge learning experience, but enjoyable

I have Nagios XI configured with the 0.4.4 NPRE client on a Windows 2012 server running websites. It's showing that the CPU is ramping to 100% in the middle of the night for a couple of hours, and the performance counter on the server shows w3wp.exe is the faulting process. However it recovers itself before I can see it. There are about 30 w3wp.exe process on this server which correspond to the same number of IIS application pools. The app pool name shows as the "Username" in task manager for each process.

Is there a way natively or a nagios plugin that will be able to identify which w3wp.exe process is going crazy occasionally?

many thanks
Rob

[mcapra]

The check_process module within NSClient++ has some options for monitoring per-process resource usage:
https://docs.nsclient.org/reference/win ... ck_process

But I don't think it will tell you the specific username associated with a process. I found this older thread where the user ended up using WMI instead:
https://forums.nsclient.org/t/checking- ... -user/3756

I'm certain this could be solved with some clever application of WMI, but I haven't spent time figuring out how that would look. Here's an informative post by @WillemDH regarding checking if a particular IIS app pool is "running":
https://outsideit.net/monitoring-iis-application-pools/

I suspect some of that work could also be used to get a specific app pool's CPU usage.

[kyang]

Thanks @mcapra!

robatwork, let us know if you have any more questions.

[robatwork]

I will take a look at those links, thanks @mcapra

[kyang]

Sounds good.

Let us know if you have any more questions.