This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Top Processes by CPU/MEM widget for Node Details

A super common question I see on Thwack is "I see I had high CPU load at 2am last night, but I don't know what processes caused the issue.  How can I find out what caused it?"

I wrote this custom query to be used in conjunction this SAM template, CPU/MEM Process Snapshot

Once you assign that template to the nodes you would add this query to the Node Details view and then you can enter the amount of minutes you want to have it jump back in time and it will show you the top processes at that time.  I find that it works best if you set it to show 12 rows (total cpu load, plus top 5 by cpu, plus total memory utilization, plus top 5 by memory).

pastedImage_1.png

First box

SELECT tolocal(TimeStamp) as Timestamp

--, cs.Component.Application.Node.Caption

--, cs.Component.Application.Name

, cs.Component.Name

, cs.Component.DetailsUrl as [_linkfor_Name]

, cs.DynamicEvidence.ColumnLabel as Label

, cs.DynamicEvidence.StringData as Message

FROM Orion.APM.ComponentStatus cs

where cs.DynamicEvidence.StringData is not null

and cs.Component.Application.Name like '%snapshot%'

--and cs.Component.Application.Node.NodeID=${NodeID}

and minutediff(timestamp,GETUTCDATE())<7

order by timestamp desc

, cs.Component.Name, label

and for the second search box use this query

SELECT tolocal(TimeStamp) as Timestamp

--, cs.Component.Application.Node.Caption

--, cs.Component.Application.Name

, cs.Component.Name

, cs.Component.DetailsUrl as [_linkfor_Name]

, cs.DynamicEvidence.ColumnLabel as Label

, cs.DynamicEvidence.StringData as Message

FROM Orion.APM.ComponentStatus cs

where cs.DynamicEvidence.StringData is not null

and cs.Component.Application.Name like '%snapshot%'

and cs.Component.Application.Node.NodeID=${NodeID}

and minutediff(timestamp,GETUTCDATE())<${SEARCH_STRING}

and minutediff(timestamp,GETUTCDATE())>(${SEARCH_STRING}-6)

order by timestamp desc--, caption, cs.Component.Application.Name

, cs.Component.Name, label

pastedImage_2.png

-Marc Netterfield

    Loop1 Systems: SolarWinds Training and Professional Services

Parents Reply Children
No Data