banshee/linux-collection/linux/snmp/cpu

Processors of a Linux host, by SNMP

Returns the load of each logical processor, the average load of the whole machine, how that load splits between user time, system time, waiting for disks and time stolen by the hypervisor, and the number of processors. Six watches are offered, each adjustable on the probe.

Versions

Generic: HOST-RESOURCES-MIB and UCD-SNMP-MIB are served the same way by net-snmp on any Linux. An agent too old to serve one of the counters read (ssCpuRawSteal, ssCpuRawSoftIRQ) stops the collector as misconfigured.

How it works

The collector reads two things from the net-snmp agent:

hrProcessorLoad (HOST-RESOURCES-MIB), one row per logical processor: the load the agent itself averages over the last minute. Processors are named cpu0, cpu1… in the agent's order.
The ssCpuRaw* counters (UCD-SNMP-MIB): user, nice, system, idle, I/O wait, interrupt, soft interrupt and steal time, in hundredths of a second since boot, for all processors together.

The average load and its split come from the counters, over the interval between two runs:

On the first run there is no previous reading yet: the run is skipped, and the values come on the next one. The same happens on the run where a counter wraps or goes backwards.
The average load counts time spent waiting for disks as idle, like the linux/ssh/cpu collector. It covers the interval between two runs, whereas each processor's load covers the last minute: the average is not the mean of the processors.
User time includes low-priority tasks (nice); system time includes hardware and software interrupts.

By default, all processors are watched; the selection can be changed on the probe.

Prerequisites

snmpd (net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.
The view granted to the poller includes HOST-RESOURCES-MIB (.1.3.6.1.2.1.25) and the systemStats group of UCD-SNMP-MIB (.1.3.6.1.4.1.2021.11). Many distributions ship a default view limited to .1.3.6.1.2.1.1 and .1.3.6.1.2.1.25.1, which is not enough.
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

# /etc/snmp/snmpd.conf
agentaddress udp:161
view   banshee included .1.3.6.1.2.1.25
view   banshee included .1.3.6.1.4.1.2021.11
# SNMPv2c, from the poller only:
rocommunity <community> 192.0.2.10 -V banshee
# or SNMPv3, after net-snmp-create-v3-user -ro -a SHA -x AES <user>:
rouser <user> priv -V banshee

Outputs

Name	Label	Unit	Per instance
`cpu-busy`	Overall processor usage	%	no
`user`	User time	%	no
`system`	System time	%	no
`iowait`	Waiting for disks	%	no
`steal`	Stolen by the hypervisor	%	no
`core-busy`	Processor usage	%	yes, per processor (`cpu0`, `cpu1`…)
`cores`	Number of processors	—	no

Watches

Name	Title	Kind	Defaults	Checked by default
`cpu-high`	Processor saturated	above a threshold, on `cpu-busy`	warning above 85 %, critical above 95 %, for 3 runs	yes
`iowait-high`	Waiting for disks	above a threshold, on `iowait`	warning above 20 %, for 5 min; no critical	yes
`steal-high`	Stolen by the hypervisor	above a threshold, on `steal`	warning above 10 %, for 5 min; no critical	yes
`core-hot`	A processor saturated	above a threshold, on `core-busy`	warning above 95 %, for 3 runs; no critical	no
`core-neglected`	A processor left idle	deviates from the others, on `core-busy`	warning when a processor is more than 30 % below the median of the others; no critical	no
`core-count`	Unexpected number of processors	expected value, on `cores`	no expected value: it raises nothing until one is set on the probe	yes

Limits

The ssCpuRaw* counters are 32 bits wide: on a machine with many processors they wrap within days, and the run where they do returns nothing.
Processor load is the agent's one-minute average: a burst shorter than a minute is smoothed.