Getting Data In
Highlighted

Process %_Processor_Time greater than 100%

Explorer

I have started collecting Process information on a virtual machine that has 1 processor. I am seeing %ProcessorTime statistics of upwards of 1000%. I understand that you could get a percentage greater than 100% on a machine with multiple sockets/cores, but that doesn't seem to be the case here. Can anyone explain what it is that I'm seeing? Running perfmon on the VM looks normal, so how can a process use a percentage of the CPU that is so high?

Highlighted

Re: Process %_Processor_Time greater than 100%

Builder

In perfmon, go to the Performance node where it give you the overview and system summary. In the lower pane, it shows processor information. Are the columns like 0,1 and 0,1? If so, these are cores that may contribute to the measure you're seeing.

0 Karma
Highlighted

Re: Process %_Processor_Time greater than 100%

Explorer

Columns are Total, 0,Total, and 0,0

0 Karma
Highlighted

Re: Process %_Processor_Time greater than 100%

Builder

Do you have access to the actual logs? Find an event that is over 100%. If you open an event, click on the Event Actions drop down, you may be able to view source. Here is an example of one of mine:
12/24/2019 15:05:44.584 -0500
collection=Process
object=Process
counter="% Processor Time"
instance=splunk-perfmon
Value=2.9410862311424606

If your event value is different from the value in the raw log, you may have an issue with the parser.

0 Karma
Highlighted

Re: Process %_Processor_Time greater than 100%

New Member

alt text

You also see like this? One people tell me that: example your cpu have 8 cores, 1 core is used 100%, it'll use from another cores. therefore i get 100,1%. hope that it'll help you understand

0 Karma
Highlighted

Re: Process %_Processor_Time greater than 100%

Explorer

alt text

The VM being monitored has 1 Core and 1 Logical Processor. The Percent of Processor Time is %17,967. Going by the NumberOfProcessors x 100 formula, the machine would need 180 sockets/cores in order to reach that number?? I could see %101 percent due to threading issues, but %18,000? The only way I could see that being accurate is if the VM had knowledge of the underlying hardware (VM Hosts) but I'm fairly sure that is not the case.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.