banshee/linux-collection/linux/snmp/cpu

Processors of a Linux host, by SNMP

Returns the load of each logical processor, the average load of the whole machine, how that load splits between user time, system time, waiting for disks and time stolen by the hypervisor, and the number of processors. Six watches are offered, each adjustable on the probe.

How it works

The collector reads two things from the net-snmp agent:

hrProcessorLoad (HOST-RESOURCES-MIB), one row per logical processor: the load the agent itself averages over the last minute. Processors are named cpu0, cpu1… in the agent's order.
The ssCpuRaw* counters (UCD-SNMP-MIB): user, nice, system, idle, I/O wait, interrupt, soft interrupt and steal time, in hundredths of a second since boot, for all processors together.

The average load and its split come from the counters, over the interval between two runs:

On the first run there is no previous reading yet: the run is skipped, and the values come on the next one. The same happens on the run where a counter wraps or goes backwards.
The average load counts time spent waiting for disks as idle, like the linux/ssh/cpu collector. It covers the interval between two runs, whereas each processor's load covers the last minute: the average is not the mean of the processors.
User time includes low-priority tasks (nice); system time includes hardware and software interrupts.

By default, all processors are watched; the selection can be changed on the probe.

Prerequisites

snmpd (net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.
The view granted to the poller includes HOST-RESOURCES-MIB (.1.3.6.1.2.1.25) and the systemStats group of UCD-SNMP-MIB (.1.3.6.1.4.1.2021.11). Many distributions ship a default view limited to .1.3.6.1.2.1.1 and .1.3.6.1.2.1.25.1, which is not enough.
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

# /etc/snmp/snmpd.conf
agentaddress udp:161
view   banshee included .1.3.6.1.2.1.25
view   banshee included .1.3.6.1.4.1.2021.11
# SNMPv2c, from the poller only:
rocommunity <community> 192.0.2.10 -V banshee
# or SNMPv3, after net-snmp-create-v3-user -ro -a SHA -x AES <user>:
rouser <user> priv -V banshee

Outputs

Name	Label	Unit	Per
`cpu-busy`	Average load	%
`user`	User time	%
`system`	System time	%
`iowait`	Waiting for disks	%
`steal`	Stolen by the hypervisor	%
`core-busy`	Processor load	%	processor
`cores`	Number of processors

Watches

Watch	Kind	Defaults	Checked
Saturation	Above a threshold, on `cpu-busy`	warning 85 %, critical 95 %, for 3 runs	yes
Waiting for disks	Above a threshold, on `iowait`	warning 20 %, for 3 runs	no
Processor taken by the hypervisor	Above a threshold, on `steal`	warning 10 %, for 3 runs	yes
A saturated processor	Above a threshold, on `core-busy`	warning 95 %, for 3 runs	no
A processor left idle	Deviates from the others, on `core-busy`	below the median of the others by more than 30 %	no
Unexpected number of processors	Expected value, on `cores`	no expected value	yes

Limits

The ssCpuRaw* counters are 32 bits wide: on a machine with many processors they wrap within days, and the run where they do returns nothing.
An agent too old to serve one of the counters read (ssCpuRawSteal, ssCpuRawSoftIRQ) stops the collector as misconfigured.
Processor load is the agent's one-minute average: a burst shorter than a minute is smoothed.