banshee/linux-collection/linux/ssh/processes

Processes of a Linux, by SSH

Returns the number of processes and of zombies, and for each process name watched, the number of its instances, their memory and their CPU time.

How it works

The collector runs cat /proc/[0-9]*/stat (the name, state and CPU times of each process) and grep -s -H ^VmRSS: /proc/[0-9]*/status (its resident memory).

Instances of the same name add up. The CPU time is the time used per second over the interval between two runs, as a share of one core: a process using two full cores shows 200 %. It has no value on the first run, nor when an instance ended and the sum went backwards.
A process that ends during the reading is simply missing from the answer.
Portable: /proc/<pid> is written by the kernel the same way on Alpine, Debian and Fedora, where the columns of ps differ; -s and -H are options of BusyBox as of GNU grep. Nothing is written on the target.

Prerequisites

an SSH account for monitoring, without write rights;
the fingerprint of the server's host key, set in protocol:ssh:fingerprint (not needed when the Security settings trust the first SSH fingerprint presented);
on a kernel mounted with hidepid, an account allowed to see the other users' processes.

Outputs

Output	Unit	Per	Meaning
`processes`	—	—	number of processes, kernel threads included
`zombies`	—	—	processes ended but not reaped by their parent
`instances`	—	process name	number of running instances
`memory`	MiB	process name	resident memory of all instances
`cpu`	%	process name	CPU time, as a share of one core

By default only sshd, cron and crond are watched; the selection is changed on the probe.

Watches

Watch	Kind	Defaults	Checked
`missing` Process missing	missing, on `instances`	no expected name	yes, raises once names are set
`zombies` Zombies piling up	above, on `zombies`	warning 20, for 3 runs	yes
`too-many` Too many processes	above, on `processes`	no threshold	no
`memory-high` Memory of a process	above, on `memory`	no threshold	no
`cpu-high` CPU of a process	above, on `cpu`	warning 90, for 3 runs	no

Limits

The name is the kernel's: 15 characters at most, without path or arguments.
No expected name by default: cron is cron on Debian and crond on Fedora and Alpine, and the SSH server may be dropbear.
The memory of processes sharing pages (forks of a server) is counted once per instance.