0

We just set up Nagios monitoring for some of our Windows (2003) servers, when looking at one of the servers I noticed this on the CPU graph

CPU Graph http://rmg.io/cms/wp-content/uploads/2011/10/showgraphCAB42ATB.png

There is clearly a (or more than one) process that is using 100% of one CPUs capacity, is there any way to identify this process? Task manager/perfmon only show total CPU usage, but our total usage is under 30% yet individual cores spike to 100% constantly.

Improve this question

2 Answers 2

Reset to default
1

I frequently use perfmon for such things. You can easily add per process counters and set it to record activity over time.

Additionally, the performance counter api is accessible via wmi namespace at win32_perfformatteddata* classes, for which you could write a script to execute and report perfdata back to your rrdtool instance (as that graph you've posted looks). Also take a look at nagios Exchange and munin's web page for add-ons that might fit your needs. (On train... Sorry for lack of linkage)

http://msdn.microsoft.com/en-us/library/aa394277(v=vs.85).aspx

Improve this answer
2
  • I'm not sure how this would help us, we don't know which process is using 100% of a single CPU, and without monitoring every process I'm not sure how we'd find that out. Commented Oct 14, 2011 at 10:38
  • Right. Monitor every process with a performance counter locally with perfmon. The counters are actually already attched to the processes, so the only overhead that is introduced is the hdd i/o that occurs from logging the performance counter data to file. How else do you expect to figure this out other than being able to review per process cpu usage? Commented Oct 14, 2011 at 10:41
0

If you do not need a solution for constant monitoring but solely for troubleshooting, take a look at Process Explorer - it will give you per-process history graphs.

BTW: you are not necessarily seeing process thread execution time eating your CPU's cycles. This might be kernel time (i.e. used by drivers, interrupts, DPCs etc) - you should enable the display of kernel times in task manager to rule this out.

Improve this answer

You must log in to answer this question.