cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

Top Processes by CPU/MEM widget for Node Details

A super common question I see on Thwack is "I see I had high CPU load at 2am last night, but I don't know what processes caused the issue.  How can I find out what caused it?"

I wrote this custom query to be used in conjunction this SAM template, CPU/MEM Process Snapshot

Once you assign that template to the nodes you would add this query to the Node Details view and then you can enter the amount of minutes you want to have it jump back in time and it will show you the top processes at that time.  I find that it works best if you set it to show 12 rows (total cpu load, plus top 5 by cpu, plus total memory utilization, plus top 5 by memory).

pastedImage_1.png

First box

SELECT tolocal(TimeStamp) as Timestamp

--, cs.Component.Application.Node.Caption

--, cs.Component.Application.Name

, cs.Component.Name

, cs.Component.DetailsUrl as [_linkfor_Name]

, cs.DynamicEvidence.ColumnLabel as Label

, cs.DynamicEvidence.StringData as Message

FROM Orion.APM.ComponentStatus cs

where cs.DynamicEvidence.StringData is not null

and cs.Component.Application.Name like '%snapshot%'

--and cs.Component.Application.Node.NodeID=${NodeID}

and minutediff(timestamp,GETUTCDATE())<7

order by timestamp desc

, cs.Component.Name, label

and for the second search box use this query

SELECT tolocal(TimeStamp) as Timestamp

--, cs.Component.Application.Node.Caption

--, cs.Component.Application.Name

, cs.Component.Name

, cs.Component.DetailsUrl as [_linkfor_Name]

, cs.DynamicEvidence.ColumnLabel as Label

, cs.DynamicEvidence.StringData as Message

FROM Orion.APM.ComponentStatus cs

where cs.DynamicEvidence.StringData is not null

and cs.Component.Application.Name like '%snapshot%'

and cs.Component.Application.Node.NodeID=${NodeID}

and minutediff(timestamp,GETUTCDATE())<${SEARCH_STRING}

and minutediff(timestamp,GETUTCDATE())>(${SEARCH_STRING}-6)

order by timestamp desc--, caption, cs.Component.Application.Name

, cs.Component.Name, label

pastedImage_2.png

-Marc Netterfield

    Loop1 Systems: SolarWinds Training and Professional Services

Comments

this will definitely help a lot 🙂 I have just got requirement to check on cpu processes for few days back..

Just a question on the node details view.. are u referring to i

1. Inserting a custom query option?

2. where does first box and second box come?

Yes this is a query meant to be used in the custom query resource.   When you edit the custom query resource the options should look like the screenshot, the first box im referring to us the one titled "custom swql query"  then you put a check in the "enable search" and the second block of code goes into the "search swql query" area.

cool.. let me give this a try...

mesverrum

Its working; but if i want to search 15 days back with specific timing then where do i need to specify it and the format? if u can help with some screenshot then even that would help...

pastedImage_0.png

It only has logic to go back based on minutes, so if you wanted to go back 15 days you would do 21600 minutes ago.  I thought about doing a more elaborate searching logic but didn't get around to it.  Also I don't know off hand how much of this data is accessible after the details data gets rolled into hourly averages (after 7 days be default).  You obviously can't average process names so I expect it might drop those values from the database.

Thanks but where do I need to mention the minutes detail? Can u show a

screenshot please...

Thats awesome. !

Hi when i selected the execution mode as remote host its asking for more details

Here what would be the URL prefix for each node?

How do I find out which protocol and which version WINRM use in a node?

pastedImage_0.png

also getting this error while using remote execution

pastedImage_0.png

There are several articles relating to how to enable winrm to allow you to execute powershell remotely, it is very often disabled or locked down by GPO

What is WinRM &amp; How Do You Configure It?

https://support.solarwinds.com/SuccessCenter/s/article/Connecting-to-remote-server-failed-with-the-m...

Version history
Revision #:
1 of 1
Last update:
‎10-24-2019 06:50 PM
Updated by: