If you have SAM, that comes as a built-in alert. The way it works is using a stand-alone utility that queries the top-10 processes at the time of the alert and stuffs it into the ${notes} variable for the alert, which you can then add to the email.
But without that utility (and the WMI account subsystem that it relies on) I don't know if you will be able to mimic it.
is correct. to add: search advanced alerts for out of box high cpu and look at trigger actions. you'll see an executable.
get on a system and run that query/tweak..you can get memory as well, etc... If you want to send an email with this info, I recommend you put a pause in it prior to sending email as it takes a few [play with this to verify you give enough time for your environment] for the command to be sent and returned; see alert escalation tab for delay). I also recommend making email HTML based so looks clean.
do you have a delay set up prior to sending the trap? This is critical. The alert triggers the actions, which triggers the command line, but you have to wait for response to be returned and populated into "notes" field before you allow the triggered action "send trap" to go out. make sure its set like your email. if this is the case, maybe open a ticket. I've never tried w/ traps.
