New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

300.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


Windows CPU sensor alert show top processes

Votes:

1

Your Vote:

Up

Down

Hi, how do you get the CPU usage alert to show the top CPU consumers for the time period?

For example we get an alert that CPU is at 100% for 5 minutes, I want to know the top 5 processes using the CPU within the alert.

Thanks

alert cpu wmi

Created on Jul 7, 2015 9:48:17 PM by  pipnz (1) 1



20 Replies

Votes:

0

Your Vote:

Up

Down

Dear Pipnz

Our CPU sensors only measure CPU load, not the processes causing the load.

Please consider solving this task with a custom sensor. You can find a Powershell script which shows how to access the process list of the local machine to extract the one process with the highest CPU load here.

Using that example code, you can expand the script to work remotely and returns the top 5 processes.

Created on Jul 9, 2015 11:44:23 AM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Thanks for the reply. I started to use PRTG due to its purported "ease of use" but am not finding this easy. Can you please detail how I would add this custom sensor to run whenever the CPU load is greater than 80% for 5 minutes? I'm not understanding how to do this. Can I get the script to run and email the value when the CPU sensors go to an alert status?

Created on Jul 9, 2015 10:44:14 PM by  pipnz (1) 1



Votes:

0

Your Vote:

Up

Down

Dear Pipnz

I am sorry, this scenario is not covered by PRTG's sensors, so custom scripting is the only way. You could add a threshold trigger to a CPU sensor with "When CPU Load (%) channe is Above 80 for at least 300 seconds perform My CPU notification"

The My CPU notification could be set up to run a script, which then could read out the task list using power shell, returning the top 5 processes.

Created on Jul 10, 2015 8:28:26 AM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi, sorry to hijack this thread.

What do you mean by returning top 5 processes, as text or XML?

Can we use them in the alert details, maybe even in an notifications email?

Is it possible to do so?

Created on Jun 29, 2016 7:37:25 PM by  kusumah (0) 1



Votes:

0

Your Vote:

Up

Down

Dear kushumah

In principle that is possible to set up, however you would get just the information from the time the sensor scanned.

Created on Jun 30, 2016 8:54:40 AM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi,

That's what I want.

When a threshold is triggered, run powershell script to list the top x processes at that time. The trigger sends an alert/notification with the output of script.

I already have the script, could you give me an example on how to put the text output into a notification/alert email.

Thanks.

Created on Jun 30, 2016 1:40:14 PM by  kusumah (0) 1



Votes:

0

Your Vote:

Up

Down

The sensor message is by default included in the according email notification. That means the custom script needs to output the information as sensor message.

Created on Jun 30, 2016 2:09:20 PM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi,

Thanks for the prompt replies.

Right now I have set a threshold trigger for the CPU Usage sensor.

When CPU is over 80% for 15 seconds, send notification ("CPUOver80").

The "CPUOver80" notification runs an .exe (ps script), the ps script (when run by itself for testing) outputs the top processes. Like so:

------------------------------------------------
Name        PercentProcessorTime
----        --------------------
chrome#35                     24
PRTG Server                    6
chrome#33                      6
------------------------------------------------

Now, how do I take that block of text and put it into the email notification of "CPUOver80". You mentioned as a sensor message. I have googled to no avail.

Should I approach things differently than what I described above?

Thanks.

Created on Jun 30, 2016 2:28:14 PM by  kusumah (0) 1

Last change on Jun 30, 2016 2:59:53 PM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Dear kusumah

A PRTG sensor cannot handle tables, only strings without line breaks. A possible sensor output could be:

24:chrome#35 uses 24%, PRTG Server uses 6%, chrome#33 uses 6%

The part in front of the colon, the number 24, would be the sensor data, in this case just the CPU load of the top process. The part after the colon is the sensor message string. The string will not be part of the historic data, it only contains information for the current status.

You can return several channels, using the XML structure conforming to the Advanced sensor API. Still, only one sensor message will be available. And it is not possible to delete sensor channels once created, so it would not make sense to create a channel per process.

This would be (an overly simple) top 3 sensor:

$processes=gwmi Win32_PerfFormattedData_PerfProc_Process | select IDProcess,Name,PercentProcessorTime | where { $_.Name -ne "_Total" -and $_.Name -ne "Idle"} | sort PercentProcessorTime -Descending | select -First 3
$top1=new-object PSObject -Property @{
  name       =$Processes[0].Name
  CPU        =$Processes[0].PercentProcessorTime
  description=(Get-Process -Id $Processes[0].IDProcess).Description
}
$top2=new-object PSObject -Property @{
  name       =$Processes[1].Name
  CPU        =$Processes[1].PercentProcessorTime
  description=(Get-Process -Id $Processes[1].IDProcess).Description
}
$top3=new-object PSObject -Property @{
  name       =$Processes[2].Name
  CPU        =$Processes[2].PercentProcessorTime
  description=(Get-Process -Id $Processes[2].IDProcess).Description
}
$top1cpu=$top1.CPU -as [string]
$top2cpu=$top2.CPU -as [string]
$top3cpu=$top3.CPU -as [string]
if ($top1.description.length -gt 0) {
$top1.name=$top1.description
}
if ($top2.description.length -gt 0) {
$top2.name=$top2.description
}
if ($top3.description.length -gt 0) {
$top3.name=$top3.description
}
$topall3=$top1.CPU+$top2.CPU+$top3.CPU
$result=$topall3 -as [string]
$result=$result+":"+$top1.name+" ("+$top1cpu+"%), "+$top2.name+" ("+$top2cpu+"%), "+$top3.name+" ("+$top3cpu+"%)"
write-host $result

This is a standard Exe/Script sensor, not an Exe/Script Advanced sensor, intentionally written in a simple way.

Created on Jun 30, 2016 3:03:26 PM by  Arne Seifert [Paessler Support]

Last change on Jun 30, 2016 3:06:40 PM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi, one line string would be fine as long as we get that information.

But as I mentioned before I am using a CPU Usage sensor, because of the threshold triggers, not an Exe/Script sensor.

I need PRTG to continuously monitor the CPU and send notification on that specific trigger (CPU over 80% for 15 seconds or more).

Please. let me re-iterate what I want to do:

Task: When CPU Usage is over 80% for 15 seconds or more, send notification email containing, among others, the top x CPU consumers at the time.

Progress: 1x CPU Usage sensor set to the above threshold, set it to send a notification that I already set up called "CPUOver80". That notification runs an .exe (powershell script) that outputs ONE line string.

Question: What do I need to do to put that string into the email send by the notification "CPUOver80".

Thanks!

Created on Jun 30, 2016 3:45:49 PM by  kusumah (0) 1



Votes:

0

Your Vote:

Up

Down

This can be done by a custom message caused by a limit. This can be set per-channel. Please open the channel configuration, Limits / Error Limit Message. This message will be part of the sensor matches, which in turn is by default included in the notification email.

Created on Jul 1, 2016 8:45:25 AM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi,

I chose the "Total CPU" channel for sensor.

Should leave the "Error Limit Message" empty?

My notification's ("CPUOver80") script will append the output of that script into that field?

Thanks!

Created on Jul 4, 2016 1:53:34 PM by  kusumah (0) 1



Votes:

0

Your Vote:

Up

Down

Hi,

Sorry forgot to ask. Should I leave the other fields empty as well? The threshold trigger already my limits (CPU over 80% for 15 seconds or more).

Upper Error Limit (%) Upper Warning Limit (%) Lower Warning Limit (%) Lower Error Limit (%) Error Limit Message Warning Limit Message

Created on Jul 4, 2016 1:57:50 PM by  kusumah (0) 1



Votes:

0

Your Vote:

Up

Down

The "Error Limit Message" field is a string which will be added to the sensor statusmessage in case the channel triggers an error by limit.

Please note that the threshold trigger you are currently using cannot add a custom message. Limits on the other hand are always triggering instantly, you cannot have a 15 seconds delay.

Created on Jul 4, 2016 2:40:40 PM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi,

So I guess it is not currently possible, doing the tasks I wanted using PRTG.

In your opinion is this the only alternative: Set PRTG to trigger a notification that runs a powershell script, that script creates and sends (internally) the information that I want (top processes, event logs) as an email?

Another question is it possible for the Event Logs sensor to list the logs and not just count them?

Thanks!

Created on Jul 4, 2016 3:37:25 PM by  kusumah (0) 1



Votes:

0

Your Vote:

Up

Down

The PRTG eventlog sensors only counts events, because a sensor channel can hold only numeric data, not strings. We consider PRTG a traditional network monitor first and foremost. You will not find a fully-fledged log analysis suite in PRTG.

Since you can run your own scripts as sensor, or as notification, you still can implement your own metrics or altert methods. Please note that PRTG will run only up to 100 exe files at the same time per probe to ensure system stability.

Created on Jul 5, 2016 8:55:13 AM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi,

I am planning to get the 500 sensor package.

My question we have 2 offices (same company), is it possible/allowed to use split that amount between each office using the same license?

More specifically, I am planning to install a prtg server at each office location, which will do their own monitoring, as they are independent, 100 sensors is not enough but 500 is too much.

Thanks.

Created on Jul 5, 2016 1:48:21 PM by  kusumah (0) 1



Votes:

0

Your Vote:

Up

Down

Dear kusumah

With one 500 sensor license, you are limit to one core server (plus a failover for clustering.) If you need two core servers with > 100 sensors, you need two 500 sensor licenses.

It might me an option to only use one core server and install a remote probe at the other side.

Created on Jul 5, 2016 2:53:14 PM by  Arne Seifert [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi,

Going back to your answer:


The "Error Limit Message" field is a string which will be added to the sensor statusmessage in case the channel triggers an error by limit. Please note that the threshold trigger you are currently using cannot add a custom message. Limits on the other hand are always triggering instantly, you cannot have a 15 seconds delay. ------

I do not get how I will get top processes here if my script is not being run by the threshold trigger of the CPU Load sensor.

So can this only be achieved using a Custom Sensor? One that returns a string of top processes as a sensor message? When a Limits is hit, that sensor message will be included in the Error Limit Message.

Another Question, that Error Limit Message what will this be sent as? Unlike notifications there is no option to send it as an email, etc.

Adding to the above, do threshold trigger and Limits interact with each other?

Thanks, K

Created on Jul 7, 2016 4:09:28 PM by  kusumah (0) 1



Votes:

0

Your Vote:

Up

Down

I am sorry for all this confusing details.

In the end, this can achieved only by a custom sensor. The idea is to run the sensor at a regular interval, not only when the CPU load is above a threshold, and return both the CPU load as well as the top process name.

Coming back to your question, threshold triggers and limits are independent. But with a custom sensor which combines CPU load and getting the name of the top process, you would ease the implementation.

Created on Jul 8, 2016 8:49:37 AM by  Arne Seifert [Paessler Support]



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.