topic Alert on overall %CPU on multicore Solaris server? in Alerting

Alert on overall %CPU on multicore Solaris server?

davidl64 — Mon, 28 Sep 2020 12:44:24 GMT

I have a saved search that goes like this:

index=os sourcetype=cpu host=* | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | search host="birdhouse" | where Percent_CPU_Load > 80

My intent was to receive an alert if the overall CPU load of the server is over 80%. However, it seems this string will trigger if any single core is over 80%, since it is reading mpstat data and seems to trigger for each line if result is over 80. Leaving aside for the moment that cpu.sh cuts off Core #0, is there a way I can trigger on the average of all the cores?

Thanks,
DL

Re: Alert on overall %CPU on multicore Solaris server?

gkanapathy — Mon, 05 Nov 2012 05:51:26 GMT

index=os sourcetype=cpu host=birdhouse | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | stats avg(Percent_CPU_Load) as Percent_CPU_Load by host | where Percent_CPU_Load > 80

Re: Alert on overall %CPU on multicore Solaris server?

sunilsk1 — Sun, 25 Aug 2013 06:19:31 GMT

Did this work for you ?
I tried the same but do not see any results