check who're consuming high resources

[Marreola]

hello guys. I have been looking for some kind of way to alert me when someone are consuming highest resources and how many they are consuming, but I didn't get success, I would like to know if somebody can help me.
I'm using Nagios core.

thx.

[mbellerue]

Hi! Welcome to the forum!

First thing to consider, are you trying to monitor a Windows or Linux host?

[Marreola]

tahnk you for attent to my request. both of them, but now i'm starting whit windows

[ssax]

Do you have an agent installed on the systems currently or are you even monitoring them at this time?

If an agent, which (NCPA or NSClient++)? Please be specific and include the exact version.

If not using an agent, what protocols are you currently using to monitor them?

Here's a quick powershell script I wrote:

Code: Select all

param (
    [string]$mode = "CPU",
    [string]$number = 10
)

$output = (Get-Process | Sort-Object $mode -desc | Select-Object -first $number | Format-Table | Out-String)

if ($output) {
    Write-Host "$output"
	exit 0
} else {
    Write-Host "UNKNOWN - Something went wrong!"
	exit 3
}

Default mode shows top 10 CPU:

Code: Select all

PS C:\Program Files\NSClient++\scripts> .\check_wintop.ps1
OK - See details for process list

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    825      83   378920     427280 102,241.74   2008   0 CarboniteService
    132      13   162668      85244  67,541.38  16312   0 TrustedInstaller
   1305       0      128        308  37,949.29      4   0 System
    932      50    57296      45656  20,728.70    880   0 svchost
    436      23    26224      37548  20,180.68   4364   0 WmiPrvSE
    438      49    97316     150736  17,861.51   4716   0 svchost
    463      16     9748      16156  16,068.98    936   0 svchost
    182      13    20668      22288  14,795.67   1176   0 audiodg
    681      38   331576     332112  12,242.60   1052   0 svchost
   2285    1667   915956     524500  10,546.18   1100   0 svchost

You can change it to use top 10 MEM (working set) if you do:

Code: Select all

PS C:\Program Files\NSClient++\scripts> .\check_wintop.ps1 MEM 10
OK - See details for process list

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    515       9     4832       8568   9,506.30  11680   1 SoftphoneCrashMonitor
   2089     420   457376     486208   1,094.96   2916   1 Softphone
     88      14     3000      11896       0.05   7404   1 SoftPhoneMapiBridge
    755      46   130480     200444      72.95  19372   1 sublime_text
    507      26    14848      23792       9.34   1728   0 spoolsv
    824      58   112156     164904   1,122.27  40580   1 slack
    402      91   288412     258364     322.73  36592   1 slack
    268      29   102148     114396   1,038.26  42884   1 slack
    195      14     6256      10184   1,594.81   3420   0 snmp
     36       1      752       1584       0.11    336   0 smss

OR top 20 MEM:

Code: Select all

PS C:\Program Files\NSClient++\scripts> .\check_wintop.ps1 MEM 20
OK - See details for process list

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    515       9     4832       8568   9,506.33  11680   1 SoftphoneCrashMonitor
   2089     420   457376     486208   1,094.96   2916   1 Softphone
     88      14     3000      11896       0.05   7404   1 SoftPhoneMapiBridge
    755      46   130480     200444      72.95  19372   1 sublime_text
    505      26    14848      23792       9.34   1728   0 spoolsv
    824      58   112156     164904   1,122.27  40580   1 slack
    402      91   288412     258364     322.73  36592   1 slack
    268      29   102148     114396   1,038.26  42884   1 slack
    195      14     6256      10184   1,594.81   3420   0 snmp
     36       1      752       1584       0.11    336   0 smss
    217      16    11436      18280      46.63   1212   0 svchost
   2272    1666   915064     523652  10,546.23   1100   0 svchost
    925      52    27956      31664   2,068.92   1484   0 svchost
    364      20    10660      16796       7.21   2324   0 svchost
    355      34    23948      25616     278.29   1756   0 svchost
    463      16     9748      16156  16,070.44    936   0 svchost
    898      45    56972      45540  20,730.26    880   0 svchost
    663      16    13196      17364     336.76   1016   0 svchost
    913      50    36984      56968     316.37   1076   0 svchost
    681      38   331576     332112  12,244.92   1052   0 svchost

Will that work?

[Marreola]

yes I'm using NSClient++ agent, this powershell lookings great but we are loking for something to check if one or more proces are consuming 'x'% of resources. is it posible? I was using NCPA with -M processes but it shows me all processes and I don't know how to filter it

[Marreola]

someone?

[mbellerue]

This is definitely going to have to be a custom written plugin. And given the scope, and how the plugin would have to be written, it's no small endeavor. You would need to dynamically read the number of resources (of a specific type, so memory in MB, CPU in...CPU cycles?). Then find all of the logged in users. Then go through each user and find all of their processes. Then find a command that gives you the number of resources of the specific type, and add them up.

It can be done. But I don't know of any plugin that already exists to do it. It might be best to start small with this one and just figure out how to collect the amount of memory a particular user is using.

[Marreola]

ok,thx.