Is there any way to get the historical data of top processes that uses CPU usage for a server

Hello everyone,

I have been struggling to get historical data of top 10 processes that are contributing to CPU load on a server. Yes, i enabled canned alert that gives top 10 processes information on the alert notes and on email when we have high CPU usage. we are doing an analysis on the devices that are getting lot of high CPU usage alerts. For this investigation, we are looking for historical data of top 10 processes for example for last one week, with hourly sample interval, what are the contributors.

From thwack, i got one custom SAM template (CPU/MEM snapshot), i imported this template and assigned it on a device to test. It started capturing the data of top 5 processes but when i want to extract the data, the values are not changing from the information column of graph (static name, value , message remains same - in the below screenshot)

https://thwack.solarwinds.com/product-forums/server-application-monitor-sam/f/forum/31979/top-processes-by-cpu-mem-widget-for-node-details

I am badly looking for someone help in this regard if anyone has gone through this requirement already. Please help.

Thanks.

Find more posts tagged with

Reports

apm

npm

sam - server application monitor

server & application monitor

Comments

Ayohliveearrow

I have been trying to get the same thing going in our environment, to mixed results. I also grabbed the custom SAM template (CPU/MEM snapshot), imported this template, and applied it to the node I was testing. I managed to get the Multiple Statistics Chart working for Top Processes (CPU) component, and I think you're on the right track.

Depending on the settings, you may need to adjust the "sample interval" to something lower to see more of a change.

I'm running into the issue trying to get historical data for the 'message' field. In the link you posted, https://thwack.solarwinds.com/products/server-application-monitor-sam/f/forum/31979/top-processes-by-cpu-mem-widget-for-node-details , the section of the query: "where cs.DynamicEvidence.StringData is not null" causes the custom query to be blank. I found another post (https://thwack.solarwinds.com/products/server-application-monitor-sam/f/forum/99006/for-powershell-monitor-where-is-multiple-statistics-data-historical-data-in-swql/311465) that references a change in SAM, which causes strings captured by the 'message' construct to no longer be written to the database.

KMSigma.SWI

I'd defer to @mesverrum on most of this since he wrote the template ( CPU/MEM Process Snapshot ) you are using.

But I imported it and assigned it to a few nodes to see what I could find. The data is there, but across two different entities:

MultipleStatisticData (for the label, message, and value)
DynamicEvidenceChart (for the date/time)

The below SWQL query can pull it both together for you:

SELECT [Component].DynamicEvidenceChart.ObservationTimestamp
     , [Component].DisplayName
     , [Component].Application.Node.DisplayName AS [Node]
     , [Component].DetailsUrl
     , [Component].Status
     , [Component].MultipleStatisticData.Label
     , [Component].MultipleStatisticData.StringData
     , [Component].MultipleStatisticData.NumericData
FROM Orion.APM.Component AS [Component]
WHERE Name = 'Top Processes (CPU)'
  AND [Component].DynamicEvidenceChart.ColumnDisabled = 'FALSE'
  AND [Component].Disabled = 'FALSE'
ORDER BY [Component].DynamicEvidenceChart.ObservationTimestamp DESC

Ayohliveearrow

That worked perfectly! Thanks @KMSigma.SWI !!