Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

How do I find unknown apps in the Connection Monitor widget?

I may be barking up the wrong tree with the basic question, so please feel free to correct me.

I have a Windows Print server with 2 vCPU that is frequently hitting 100% CPU Usage. The admin for that server is blaming the Splunk Agent, but I'm not seeing evidence of this (see my other recent thread about using SAM to monitor the agent itself). I'm not sure how I can find what is eating the CPU, and I don't want to run a full application discovery against it and apply templates that are meaningless.

One thing I'm curious about (that may or may not be related) is in the "Application Connections" widget. In it, the node is listed as having two "Unknown App(s)" communicating with two of our Domain Controllers. Specifically, traffic is shown to be hitting lsass.exe and svchost.exe on the domain controller nodes. But.. I have no idea how to determine what is generating those. There's no listing of ports or processes that may be initiating this communication.

Is there any way (short of getting on the box and running network traces) to see what is communicating on those ports?

Find more posts tagged with

Accepted answers

neomatrix1217

Have you tried this alert?

Real-Time Process Explorer alerts in SAM (solarwinds.com)

All comments

neomatrix1217

Have you tried this alert?

Real-Time Process Explorer alerts in SAM (solarwinds.com)

ahbrook

I had not! But that makes a ton of sense, especially when it comes to "Catching" what is using these! We've been fairly shy about making new alerts so far, to avoid making the system too complex. We've especially avoided one-offs. But this could likely do the trick.