Windows CPU sensor alert show top processes

Dear Pipnz

Our CPU sensors only measure CPU load, not the processes causing the load.

Please consider solving this task with a custom sensor. You can find a Powershell script which shows how to access the process list of the local machine to extract the one process with the highest CPU load here.

Using that example code, you can expand the script to work remotely and returns the top 5 processes.

Thanks for the reply. I started to use PRTG due to its purported "ease of use" but am not finding this easy. Can you please detail how I would add this custom sensor to run whenever the CPU load is greater than 80% for 5 minutes? I'm not understanding how to do this. Can I get the script to run and email the value when the CPU sensors go to an alert status?

Dear Pipnz

I am sorry, this scenario is not covered by PRTG's sensors, so custom scripting is the only way. You could add a threshold trigger to a CPU sensor with "When CPU Load (%) channe is Above 80 for at least 300 seconds perform My CPU notification"

The My CPU notification could be set up to run a script, which then could read out the task list using power shell, returning the top 5 processes.

Hi, sorry to hijack this thread.

What do you mean by returning top 5 processes, as text or XML?

Can we use them in the alert details, maybe even in an notifications email?

Is it possible to do so?

Dear kushumah

In principle that is possible to set up, however you would get just the information from the time the sensor scanned.

Hi,

That's what I want.

When a threshold is triggered, run powershell script to list the top x processes at that time. The trigger sends an alert/notification with the output of script.

I already have the script, could you give me an example on how to put the text output into a notification/alert email.

Thanks.

The sensor message is by default included in the according email notification. That means the custom script needs to output the information as sensor message.

Hi,

Thanks for the prompt replies.

Right now I have set a threshold trigger for the CPU Usage sensor.

When CPU is over 80% for 15 seconds, send notification ("CPUOver80").

The "CPUOver80" notification runs an .exe (ps script), the ps script (when run by itself for testing) outputs the top processes. Like so:

------------------------------------------------
Name        PercentProcessorTime
----        --------------------
chrome#35                     24
PRTG Server                    6
chrome#33                      6
------------------------------------------------

Now, how do I take that block of text and put it into the email notification of "CPUOver80". You mentioned as a sensor message. I have googled to no avail.

Should I approach things differently than what I described above?

Thanks.

Dear kusumah

A PRTG sensor cannot handle tables, only strings without line breaks. A possible sensor output could be:

24:chrome#35 uses 24%, PRTG Server uses 6%, chrome#33 uses 6%

The part in front of the colon, the number 24, would be the sensor data, in this case just the CPU load of the top process. The part after the colon is the sensor message string. The string will not be part of the historic data, it only contains information for the current status.

You can return several channels, using the XML structure conforming to the Advanced sensor API. Still, only one sensor message will be available. And it is not possible to delete sensor channels once created, so it would not make sense to create a channel per process.

This would be (an overly simple) top 3 sensor:

$processes=gwmi Win32_PerfFormattedData_PerfProc_Process | select IDProcess,Name,PercentProcessorTime | where { $_.Name -ne "_Total" -and $_.Name -ne "Idle"} | sort PercentProcessorTime -Descending | select -First 3
$top1=new-object PSObject -Property @{
  name       =$Processes[0].Name
  CPU        =$Processes[0].PercentProcessorTime
  description=(Get-Process -Id $Processes[0].IDProcess).Description
}
$top2=new-object PSObject -Property @{
  name       =$Processes[1].Name
  CPU        =$Processes[1].PercentProcessorTime
  description=(Get-Process -Id $Processes[1].IDProcess).Description
}
$top3=new-object PSObject -Property @{
  name       =$Processes[2].Name
  CPU        =$Processes[2].PercentProcessorTime
  description=(Get-Process -Id $Processes[2].IDProcess).Description
}
$top1cpu=$top1.CPU -as [string]
$top2cpu=$top2.CPU -as [string]
$top3cpu=$top3.CPU -as [string]
if ($top1.description.length -gt 0) {
$top1.name=$top1.description
}
if ($top2.description.length -gt 0) {
$top2.name=$top2.description
}
if ($top3.description.length -gt 0) {
$top3.name=$top3.description
}
$topall3=$top1.CPU+$top2.CPU+$top3.CPU
$result=$topall3 -as [string]
$result=$result+":"+$top1.name+" ("+$top1cpu+"%), "+$top2.name+" ("+$top2cpu+"%), "+$top3.name+" ("+$top3cpu+"%)"
write-host $result

This is a standard Exe/Script sensor, not an Exe/Script Advanced sensor, intentionally written in a simple way.

Hi, one line string would be fine as long as we get that information.

But as I mentioned before I am using a CPU Usage sensor, because of the threshold triggers, not an Exe/Script sensor.

I need PRTG to continuously monitor the CPU and send notification on that specific trigger (CPU over 80% for 15 seconds or more).

Please. let me re-iterate what I want to do:

Task: When CPU Usage is over 80% for 15 seconds or more, send notification email containing, among others, the top x CPU consumers at the time.

Progress: 1x CPU Usage sensor set to the above threshold, set it to send a notification that I already set up called "CPUOver80". That notification runs an .exe (powershell script) that outputs ONE line string.

Question: What do I need to do to put that string into the email send by the notification "CPUOver80".

Thanks!

This can be done by a custom message caused by a limit. This can be set per-channel. Please open the channel configuration, Limits / Error Limit Message. This message will be part of the sensor matches, which in turn is by default included in the notification email.

Hi,

I chose the "Total CPU" channel for sensor.

Should leave the "Error Limit Message" empty?

My notification's ("CPUOver80") script will append the output of that script into that field?

Thanks!

Hi,

Sorry forgot to ask. Should I leave the other fields empty as well? The threshold trigger already my limits (CPU over 80% for 15 seconds or more).

Upper Error Limit (%) Upper Warning Limit (%) Lower Warning Limit (%) Lower Error Limit (%) Error Limit Message Warning Limit Message

The "Error Limit Message" field is a string which will be added to the sensor statusmessage in case the channel triggers an error by limit.

Please note that the threshold trigger you are currently using cannot add a custom message. Limits on the other hand are always triggering instantly, you cannot have a 15 seconds delay.

Hi,

So I guess it is not currently possible, doing the tasks I wanted using PRTG.

In your opinion is this the only alternative: Set PRTG to trigger a notification that runs a powershell script, that script creates and sends (internally) the information that I want (top processes, event logs) as an email?

Another question is it possible for the Event Logs sensor to list the logs and not just count them?

Thanks!

The PRTG eventlog sensors only counts events, because a sensor channel can hold only numeric data, not strings. We consider PRTG a traditional network monitor first and foremost. You will not find a fully-fledged log analysis suite in PRTG.

Since you can run your own scripts as sensor, or as notification, you still can implement your own metrics or altert methods. Please note that PRTG will run only up to 100 exe files at the same time per probe to ensure system stability.

Hi,

I am planning to get the 500 sensor package.

My question we have 2 offices (same company), is it possible/allowed to use split that amount between each office using the same license?

More specifically, I am planning to install a prtg server at each office location, which will do their own monitoring, as they are independent, 100 sensors is not enough but 500 is too much.

Thanks.

Dear kusumah

With one 500 sensor license, you are limit to one core server (plus a failover for clustering.) If you need two core servers with > 100 sensors, you need two 500 sensor licenses.

It might me an option to only use one core server and install a remote probe at the other side.

Hi,

Going back to your answer:

The "Error Limit Message" field is a string which will be added to the sensor statusmessage in case the channel triggers an error by limit. Please note that the threshold trigger you are currently using cannot add a custom message. Limits on the other hand are always triggering instantly, you cannot have a 15 seconds delay. ------

I do not get how I will get top processes here if my script is not being run by the threshold trigger of the CPU Load sensor.

So can this only be achieved using a Custom Sensor? One that returns a string of top processes as a sensor message? When a Limits is hit, that sensor message will be included in the Error Limit Message.

Another Question, that Error Limit Message what will this be sent as? Unlike notifications there is no option to send it as an email, etc.

Adding to the above, do threshold trigger and Limits interact with each other?

Thanks, K

I am sorry for all this confusing details.

In the end, this can achieved only by a custom sensor. The idea is to run the sensor at a regular interval, not only when the CPU load is above a threshold, and return both the CPU load as well as the top process name.

Coming back to your question, threshold triggers and limits are independent. But with a custom sensor which combines CPU load and getting the name of the top process, you would ease the implementation.