Version 3

    This Script will monitor the top XX processes. It uses the max limitation of SAM Script Monitors of 10 statistics.

    Be very careful when interpreting the data as the message will only show the current high process.

    This means that when viewing the historical dashboard that the chart is showing P0 - PX, not Process A - Process X.


    To install, create a new PowerShell monitor in SAM.

    Execution Mode: Local Host

    Run the script under specified account: True

    Due to the nature of how this is reported, I'm capturing the historical event using the Email a Web Page trigger action in Advanced Alerts. My trigger conditions are for CPU Utilization exceeding 30 % (node property/object type). For my web page, I navigated to the application details page, and "popped out" the resource I needed by clicking the resource header. Then, with some minor modifications (I'm having to use the username/password passthrough method):

    http://[YOURORIONSERVER]/Orion/DetachResource.aspx?NetObject=AA:${SQL:SELECT a.ApplicationID FROM APM_AlertsandReportsData a JOIN Nodes n on a.NodeID=n.NodeID WHERE a.ApplicationName = '[NAME OF YOUR APPLICATION MONITOR]' AND n.NodeID=${NodeID}}&ResourceID=258&AccountID=[THIS IS NOT THE USERNAME YOU ARE LOOKING FOR]&Password=[THIS IS NOT THE PASSWORD YOU ARE LOOKING FOR]

    Make sure that you grab the right URL Host, resource ID, and Application Name. In my case, I have this set to send events updates every 5 minutes without the ability to disable the action by acknowledging. This will let you capture the historical information you need to determine the process aggravating the CPU during the event.

    Special thanks to mrxinu for showing me a much more elegant way of handling my data.