cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 8

Historical view of cpu usage

Is it possible to view determine what process was using CPU at a given point in time in the past, and if so, how far back can we go. Problem is we don't know what process or service it was. this is on a Windows server.

0 Kudos
3 Replies

You can only go back as far as you have configured the product to save data.  Likely the data has had it's data point aggregated to more of an average without the peaks and valleys so yuou lose the critical data points you may need.

You should help us push forth the data warehouse concept to allow proper detailed reporting over time in the following idea:

https://thwack.solarwinds.com/ideas/2637#start=300

If you didn't already set up a method of tracking it then that data is not collected out of the box.  I created a SAM template for specifically this use case a while back and recently uploaded it to thwack here

CPU/MEM Process Snapshot

I also have a custom SWQL query I use with that template on my node details pages so i can just specify how many minutes back I want it to look and it will show me the top 5 processes by cpu and by mem utilization at that time.  I keep meaning to rework the search logic so I can just drop a timestamp in there and get to it that way, just haven't written up the code to parse the timestamps yet.

SELECT tolocal(TimeStamp) as Timestamp

--, cs.Component.Application.Node.Caption

--, cs.Component.Application.Name

, cs.Component.Name

, cs.Component.DetailsUrl as [_linkfor_Name]

, cs.DynamicEvidence.ColumnLabel as Label

, cs.DynamicEvidence.StringData as Message

FROM Orion.APM.ComponentStatus cs

where cs.DynamicEvidence.StringData is not null

and cs.Component.Application.Name like '%snapshot%'

and cs.Component.Application.Node.NodeID=${NodeID}

--and minutediff(timestamp,GETUTCDATE())<${SEARCH_STRING}

--and minutediff(timestamp,GETUTCDATE())>(${SEARCH_STRING}-6)

order by timestamp desc--, caption, cs.Component.Application.Name

, cs.Component.Name, label

-Marc Netterfield

    Loop1 Systems: SolarWinds Training and Professional Services

- Marc Netterfield, Github

Hi, I have implemented it in my environment for testing.

My CPU is at 100% and the processes which causing it is no where showing by your suggested template or Query,its not even showing CPU correct utilization. not sure what is missing. I can see by RTPE which process is eating most CPU but your template result is different. somehow. Can you suggest here pls.

 

0 Kudos