topic Worker Process CPU and RAM monitoring in Getting Data In

Worker Process CPU and RAM monitoring

developmenttool — Wed, 15 Jul 2020 13:34:12 GMT

Hi Team,

I want to monitor individual CPU and RAM of the worker processes which I get when I run

C:\Windows\System32\inetsrv>appcmd list wps

Please let me know how to onboard the CPU and RAM metrics of these worker processes.

Regards,

Vedhajanani

Re: Worker Process CPU and RAM monitoring

gcusello — Wed, 15 Jul 2020 14:12:35 GMT

Hi @developmenttool,

you can create a scripted input, in other words, in Splunk it's possible to schedule and run a script taking the output directly in Splunk.

then you can parse the results to extract the values you want.

The instrauctions to do this are:

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2004/AdvancedDev/ScriptedInputsIntro

Check in Splunkbase if there's a Technical Add-On that already does your need.

Ciao.

Giuseppe

Re: Worker Process CPU and RAM monitoring

developmenttool — Wed, 15 Jul 2020 14:45:27 GMT

Hi Giuseppe,

I am thinking to keep the powershell script and scripted input as a last option if there is no native splunk capability. I have tried to enable perfmon counters and instances as wildcard and checked the logs using Splunk App for Infrastructure.

[perfmon://CPU]
counters = *
instances = *
interval = 60
object = Processor
mode = single
useEnglishOnly = true
sourcetype = PerfmonMetrics:CPU
index = em_metrics

But still I cannot find these application pools as metric names in the query

|mstats avg(_value) prestats=true WHERE environment="PROD" AND entity_type="Windows_Host" AND host=myhost AND metric_name=* AND "index"="em_*" span=1m BY "host"
|timechart avg(_value) as "Avg" agg=max limit=100 useother=false span=5m BY "metric_name".

Please let me know if there is any other native option.

Regards,

Vedhajanani

Re: Worker Process CPU and RAM monitoring

gcusello — Wed, 15 Jul 2020 15:07:44 GMT

Hi @developmenttool,

as I said, see in Splunkbase, TA section, if there's a TA that takes the information you need (maybe the TA-Windows is sufficient).

then how to deploy results is an easy following problem, the main job is to extract data.

Ciao.

Giuseppe

Re: Worker Process CPU and RAM monitoring

developmenttool — Wed, 22 Jul 2020 07:57:13 GMT

Hi @gcusello ,

https://docs.splunk.com/Documentation/WindowsAddOn/8.0.0/User/Configuration

I cannot find any config which monitors the CPU and memory for worker processes

So we should proceed with scripted input only right?

https://www.anexinet.com/blog/powershell-script-to-list-worker-processors-and-their-application-pool-names-with-memory-consumption-and-cpu-utilization/

Please help me if you can suggest any better native add-on which does the same.

Regards,

Vedhajanani

Re: Worker Process CPU and RAM monitoring

gcusello — Wed, 22 Jul 2020 09:24:52 GMT

Hi @developmenttool,

Sorry, I didn't used scripted inputs for this scope, only for others!

but if you well know the script to obtain your result, you can run it in Splunk inseriting the script input in inputs.conf.

To understand how to use scripted inputs, you can see documentation or copy and modify a scripted inputs in TA_Windows.

In this way the script output will be ingested in Splunk.

Then you have to parse the results to extract the structured informations.

I cannot help you in script development, I can help you in results parsing.

Ciao.

Giuseppe

Re: Worker Process CPU and RAM monitoring

developmenttool — Wed, 22 Jul 2020 12:49:07 GMT

Hii @gcusello ,

Yes. I have the working script and I can configure the scripted input as well. I would like to confirm if there is any splunk native add-on which does the same thing so that I can use the add-on itself instead of scripted input. If you confirm that there is no TA config for this, I will go with my scripted input itself.

Regards,

Vedhajanani

Re: Worker Process CPU and RAM monitoring

gcusello — Wed, 22 Jul 2020 12:58:20 GMT

Hi @developmenttool,

I don't know it but I cannot exclude that it exists!

Anyway, if you have the script you can add it to the TA_Windows ot create your own TA.

Then you have to parse the output.

Ciao.

Giuseppe

Re: Worker Process CPU and RAM monitoring

developmenttool — Fri, 24 Jul 2020 13:33:45 GMT

Hi @gcusello ,

I am going with scripted inputs in my windows universal forwarder. This is my configuration in inputs:

[powershell://Processes-EX1]
disabled = false
script = . "C:\Program Files\SplunkUniversalForwarder\etc\apps\myapp\bin\WPSMonitor.ps1"
index = myindex
schedule = * * * * *
sourcetype = stdout:wps:script

It is entering my script WPSMonitor.ps1 but it is throwing the below error:

ERROR Executing script=. "C:\Program Files\SplunkUniversalForwarder\etc\apps\myapp\bin\WPSMonitor.ps1" for stanza=Processes-EX1 failed with exception=The term 'â€œHandle=â€' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again

I have used $filter = “Handle=” + $p.Id in my script.

Do you have any idea on this error?

Regards,

Vedhajanani

Re: Worker Process CPU and RAM monitoring

gcusello — Fri, 24 Jul 2020 13:40:11 GMT

Hi @developmenttool,

Sorry, I'm not an expert in scripting!

only one dubt: the cron scheduling executes the script every minute, are you sure?

Ciao.

Giuseppe