Component Process Count over Threshold (Linux)

The Process Monitors for components have out of the box thresholds for:

  • CPU
  • Physical Memory
  • Virtual Memory
  • I/O Read
  • I/O Write
  • I/O Total

But one we're missing is for process count.  This is an effort to implement a workaround to alert when a count is over a certain threshold.

Type: Custom SWQL

This is the basis of the alert in SWQL from the alert (but there are additional notes in the alert)

SELECT TOP 1000 [Component].Uri
     , [Component].DisplayName
FROM Orion.APM.Component AS [Component]
WHERE [Component].ProcessEvidenceChart.AvgInstanceCount BETWEEN 1 AND 150
  AND [Component].Application.Node.Vendor = 'Linux'

This can easily be tuned for different vendors (by changing the filter) or filtering for specific component names.


Component Monitors require Server & Application Monitor (SAM) or Hybrid Cloud Observability.

Out of the box thresholds for SAM Process monitors

Inspired by

Looking for help on application monitor/command - Forum - Server & Application Monitor (SAM) - THWACK - SolarWinds Community

Related Items:

Add Metric Thresholds to Process Monitor Component - Feature Requests - Server & Application Monitor (SAM) - THWACK - SolarWinds Community