banshee/windows-collection/windows/snmp/processes

Processes of a Windows, by SNMP

Returns the number of processes of a Windows and, for each process name followed (lsass.exe, sqlservr.exe), the number of its instances, their memory and their processor time. Four watches are proposed, each one set on the probe, among them the process that should run and does not.

Versions

Generic: written for the SNMP agent of Windows, the feature "SNMP Service" of Windows Server or the optional feature of Windows 10 and 11, and for HOST-RESOURCES-MIB, which it serves. That every release of Windows serves it alike is assumed, not yet checked on a real Windows.

How it works

The collector reads, in HOST-RESOURCES-MIB:

hrSystemProcesses (1.3.6.1.2.1.25.1.6.0), the number of processes loaded or running;
by hrSWRunIndex, hrSWRunName (1.3.6.1.2.1.25.4.2.1.2, the name of the program, svchost.exe), and from hrSWRunPerfTable, hrSWRunPerfCPU (1.3.6.1.2.1.25.5.1.1.1, the processor time consumed since the process started, in hundredths of a second) and hrSWRunPerfMem (1.3.6.1.2.1.25.5.1.1.2, the real memory, in KiB).

Then:

The instances of one name add up: their count, their memory (returned in MiB) and their processor time.
The processor time is the rate of that sum: hundredths of a second consumed per second, that is a percentage of one processor. It can pass 100 % on a machine of several processors.
The processor time comes from the second run on: at the first run there is no earlier reading to compare with, and the value is not returned; nor is it when an instance ended and the sum went back. The count and the memory come at once.
A process that ended between the reading of two columns lacks some of its own, and counts for zero in what it lacks.
The selection is limited to lsass.exe and services.exe: a Windows runs hundreds of processes, most of them of no interest. Add on the probe the names of the processes to follow.

Nothing is written to the Windows: SNMP reads only.

Prerequisites

The SNMP service of Windows, installed and started: - on Windows Server, the feature "SNMP Service" (Server Manager, Add Roles and Features; or Install-WindowsFeature SNMP-Service in PowerShell); - on Windows 10 and 11, the optional feature "Simple Network Management Protocol (SNMP)" (Settings, Optional features; or Add-WindowsCapability -Online -Name SNMP.Client~~~~0.0.1.0 in PowerShell).
In the properties of the service "SNMP Service", tab Security: - a community with the right READ ONLY, which banshee reads in protocol:snmp:v2c:community; - under "Accept SNMP packets from these hosts", the address of the poller.
SNMPv3: the SNMP agent of Windows does not offer it; protocol:snmp:version stays v2c. The community then travels in clear text: keep it read-only and accepted from the poller alone.
The Windows firewall open to the poller on UDP 161 (the rule "SNMP Service (UDP In)").

Outputs

Name	Label	Unit	Per instance
`processes`	Number of processes	—	no
`instances`	Number of instances	—	yes, per process name
`memory`	Memory	MiB	yes, per process name
`cpu`	Processor time, as a share of one processor	%	yes, per process name

Watches

Name	Title	Kind	Defaults	Checked by default
`missing`	Process missing	expected instances, on `instances`	critical when `lsass.exe` or `services.exe` is missing; no warning	yes
`too-many`	Too many processes	above a threshold, on `processes`	no threshold: to set on the probe	no
`memory-high`	Memory of a process	above a threshold, on `memory`	no threshold: to set on the probe	no
`cpu-high`	Processor of a process	above a threshold, on `cpu`	warning above 90 %, for 3 runs; no critical	no

"Process missing" looks at every process returned, inside the selection or not: a name added to it need not be added to the selection.

Limits

A process is known by the name of its program only: its arguments (hrSWRunParameters) are not read, so two services hosted by svchost.exe are one name.
"Too many processes" and "Memory of a process" have no default threshold: what is normal depends on the role of the server.
The SNMP agent of Windows serves neither the handles, nor the threads, nor the disk activity of a process: none of them can be returned here.