banshee/linux-collection/linux/snmp/processes

Processes of a Linux host, by SNMP

Returns the number of processes, and for each process name followed, the number of its instances, their memory and their processor time. Four watches are offered, each adjustable on the probe.

Versions

Generic: HOST-RESOURCES-MIB is served the same way by net-snmp on any Linux.

How it works

The collector reads hrSystemProcesses, then hrSWRunTable and hrSWRunPerfTable (HOST-RESOURCES-MIB): for each process, its name, the processor time it has used since it started, in hundredths of a second, and its real memory, in KiB.

Instances of the same name add up: three postgres processes make one line, with three instances.
Processor time comes from a counter, over the interval between two runs: on the first run it is not returned, nor on a run where an instance has ended and the sum went backwards. It reads as a share of one processor: a process that keeps two processors busy shows 200 %.
The default selection follows sshd, cron and crond only; the selection can be changed on the probe (only these names, or all but some).

Prerequisites

snmpd (net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.
The view granted to the poller includes HOST-RESOURCES-MIB (.1.3.6.1.2.1.25).
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

# /etc/snmp/snmpd.conf
agentaddress udp:161
view   banshee included .1.3.6.1.2.1.25
rocommunity <community> 192.0.2.10 -V banshee
# or: rouser <user> priv -V banshee

Outputs

Name	Label	Unit	Per instance
`processes`	Number of processes	—	no
`instances`	Number of instances	—	yes, per process
`memory`	Memory	MiB	yes, per process
`cpu`	Processor time, as a share of one processor	%	yes, per process

Watches

Name	Title	Kind	Defaults	Checked by default
`missing`	Process missing	expected instances, on `instances`	critical when `sshd` is missing	yes
`too-many`	Too many processes	above a threshold, on `processes`	no threshold	no
`memory-high`	Memory of a process	above a threshold, on `memory`	no threshold	no
`cpu-high`	Processor of a process	above a threshold, on `cpu`	warning above 90 %, for 3 runs; no critical	no

Limits

net-snmp names a process as the kernel does, by its first 15 characters: kube-controller-manager is followed as kube-controller. Two programs with the same short name add up.
The arguments of a process are not read: two Java services are one java line.
Walking the whole process table costs one SNMP exchange per few processes: on a host with tens of thousands of processes, a run takes long.