banshee/linux-collection/linux/ssh/processes

Processes of a Linux, by SSH

Returns the number of processes and of zombies, and for each process name watched, the number of its instances, their memory and their processor time.

Versions

Generic: /proc/<pid> is written by the kernel the same way on Alpine, Debian and Fedora, where the columns of ps differ; -s and -H are options of BusyBox as of GNU grep.

How it works

The collector runs cat /proc/[0-9]*/stat (the name, state and CPU times of each process) and grep -s -H ^VmRSS: /proc/[0-9]*/status (its resident memory).

Instances of the same name add up. The processor time is the time used per second over the interval between two runs, as a share of one processor: a process using two full processors shows 200 %. It has no value on the first run, nor when an instance ended and the sum went backwards.
A process that ends during the reading is simply missing from the answer.
Nothing is written on the target.

Prerequisites

an SSH account for monitoring, without write rights;
the fingerprint of the server's host key, set in protocol:ssh:fingerprint (not needed when the Security settings trust the first SSH fingerprint presented);
on a kernel mounted with hidepid, an account allowed to see the other users' processes.

Outputs

Name	Label	Unit	Per instance
`processes`	Number of processes	—	no
`zombies`	Zombie processes	—	no
`instances`	Number of instances	—	yes, per process name
`memory`	Memory	MiB	yes, per process name
`cpu`	Processor time, as a share of one processor	%	yes, per process name

The processes count the kernel threads; a zombie is a process ended but not reaped by its parent; the memory is the resident memory of all instances. By default only sshd, cron and crond are watched; the selection is changed on the probe.

Watches

Name	Title	Kind	Defaults	Checked by default
`missing`	Process missing	expected instances, on `instances`	critical when `sshd` is missing	yes
`zombies`	Zombies piling up	above a threshold, on `zombies`	warning above 20, for 3 runs; no critical	yes
`too-many`	Too many processes	above a threshold, on `processes`	no threshold	no
`memory-high`	Memory of a process	above a threshold, on `memory`	no threshold	no
`cpu-high`	Processor of a process	above a threshold, on `cpu`	warning above 90 %, for 3 runs; no critical	no

Limits

The name is the kernel's: 15 characters at most, without path or arguments.
No expected name by default: cron is cron on Debian and crond on Fedora and Alpine, and the SSH server may be dropbear.
The memory of processes sharing pages (forks of a server) is counted once per instance.