Interpreting memory, memory_rss + memory_vms proc chk result

[jkelly1959]

We currently are attempting to monitor and track memory usage on a specific set of windows processes using the following example.
check_ncpa.py -H xxxxxxx -P 5666 -t 'nagiosapi' -M 'processes' -c 0 -q 'mem_percent=80,name=PmwRobot-server-5.exe'

As we understand it, it returns a count if it is above 80% and sends back memory, memory_rss and memory_vms to graph. A typical check might return.
Total Memory: 5.00 % (VMS 4.29 GB, RSS 4.29 GB) yet in resource monitor we see numbers higher that 4.29 in working set(kb) commit(kb) sharabl(kb) private(kb) for the same process.

In addition even nagios with the windowscounter command brings back 4.29g consistantly for other process on other servers.
And powershell virual bytes brings back an event different number.

Code: Select all

PS C:\Users\JKELLYA> Get-Counter -Counter '\Process(*PmwRobot-server-5)\Virtual Bytes' -MaxSamples 1

Timestamp                 CounterSamples
---------                 --------------
6/24/2020 1:59:59 PM      \\clbupmwhqpcf003\process(pmwrobot-server-5)\virtual bytes :
                          12941594624

How do we verify the accuracy of the numbers being returned by the check and would our check alert if %Memory used by process goes over 80% How should we interpret memory_rss and Memory_vms to the developers using the Resource Monitor?

Thanks
John

[ssax]

What version OS and what version NCPA are you using? NCPA uses the values returned from PSUtils python library, I'll lab it up and see what I find.

[jkelly1959]

The server we are running the checks on is a Windows 2012 R2 datacenter

FYI I will be on vacation till 7/7. Will try to get coworker to check postings while Im out if you need more info.


We trying some commands to compare on a windows 2016 datacenter server. where we say simliar 4.29G numbers on the one metric.

John

[ssax]

Ok, I labbed this up with both Windows 2010 AND Server 2012 (I don't have datacenter edition) with NCPA 2.2.2 and both matched the output of what WMI shows:

Code: Select all

Get-WmiObject Win32_PerfFormattedData_PerfProc_Process `
    | Where-Object { $_.name -inotmatch '_total|idle' } `
    | ForEach-Object { 
    	$RAM= Get-WMIObject Win32_PhysicalMemory | Measure -Property capacity -Sum | %{$_.sum/1Mb} 
        "Process={0,-25} CPU_Usage={1,-12} Memory_Usage_(MB)={2,-16}" -f `
            $_.Name,$_.PercentProcessorTime,([math]::Round(($_.WorkingSetPrivate/1Mb)/$RAM*100,2))
    }

Taken from here:

https://stackoverflow.com/a/39251507

The resource monitor information didn't match what WMI shows on either of my systems, I'm thinking resource monitor includes cached/sharedmemory space. Working - Shared = Private.

https://docs.microsoft.com/en-us/window ... emory-leak