banshee/linux-collection/linux/snmp/processes

Processes of a Linux host, by SNMP

Returns the number of processes, and for each process name followed, the number of its instances, their memory and their processor time. Four watches are offered, each adjustable on the probe.

How it works

The collector reads hrSystemProcesses, then hrSWRunTable and hrSWRunPerfTable (HOST-RESOURCES-MIB): for each process, its name, the processor time it has used since it started, in hundredths of a second, and its real memory, in KiB.

Instances of the same name add up: three postgres processes make one line, with three instances.
Processor time comes from a counter, over the interval between two runs: on the first run it is not returned, nor on a run where an instance has ended and the sum went backwards. It reads as a share of one processor: a process that keeps two processors busy shows 200 %.
The default selection follows sshd, cron and crond only; the selection can be changed on the probe (only these names, or all but some).

Prerequisites

snmpd (net-snmp) running on the host, listening on an address the poller reaches (UDP 161), with the firewall open to the poller only.
The view granted to the poller includes HOST-RESOURCES-MIB (.1.3.6.1.2.1.25).
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

# /etc/snmp/snmpd.conf
agentaddress udp:161
view   banshee included .1.3.6.1.2.1.25
rocommunity <community> 192.0.2.10 -V banshee
# or: rouser <user> priv -V banshee

Outputs

Name	Label	Unit	Per
`processes`	Number of processes
`instances`	Number of instances		process
`memory`	Memory	MiB	process
`cpu`	Processor time, as a share of one processor	%	process

Watches

Watch	Kind	Defaults	Checked
Missing process	Expected instances, on `instances`	critical when `sshd` is missing	yes
Too many processes	Above a threshold, on `processes`	no threshold	no
Memory of a process	Above a threshold, on `memory`	no threshold	no
Processor of a process	Above a threshold, on `cpu`	warning 90 %, for 3 runs	no

Limits

net-snmp names a process as the kernel does, by its first 15 characters: kube-controller-manager is followed as kube-controller. Two programs with the same short name add up.
The arguments of a process are not read: two Java services are one java line.
Walking the whole process table costs one SNMP exchange per few processes: on a host with tens of thousands of processes, a run takes long.