Community

banshee is under active development: collectors will keep changing, and a version you publish will likely need adjustments. For stable use, wait for version 1.0.0.

Windows

banshee/windows-collection/windows/ssh/

cpu

The usage of each logical processor of a Windows, their average and the kernel time, by SSH and PowerShell

  • windows
  • ssh
  • powershell
  • cpu

by banshee1 installation2 versions

v2Latest

Published on October 28, 2026. One naming convention across collections; documentation completed.

Processors of a Windows, by SSH

Returns the usage of each logical processor of a Windows, the average usage of all of them, the share of time spent in kernel mode, and how many processors there are. Four watches are proposed, each one set on the probe.

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the OpenSSH server is built in from Windows Server 2019 and Windows 10 1809, installed from Win32-OpenSSH before. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

The collector runs one PowerShell command that reads the raw counters of Win32_PerfRawData_PerfOS_Processor, one object per logical processor:

powershell -NoProfile -NonInteractive -Command "ConvertTo-Json -Compress -InputObject @(Get-CimInstance Win32_PerfRawData_PerfOS_Processor | Select-Object Name, PercentProcessorTime, PercentPrivilegedTime, Timestamp_Sys100NS)"
  • PercentProcessorTime counts, despite its name, the idle time of the processor, and PercentPrivilegedTime its time in kernel mode, both in hundreds of nanoseconds since boot; Timestamp_Sys100NS is the clock they are read against. The usage over the interval is 1 − idle / clock, from the differences between two runs: exact, whatever the duration of the SSH call.
  • The raw counters, not the formatted ones (Win32_PerfFormattedData_*): a formatted percentage needs two samples taken by the same process, and each run starts a new PowerShell.
  • The names of the classes and counters are English whatever the language of Windows, where the paths of Get-Counter are translated.
  • Each processor is named cpu0, cpu1… after the number Windows gives it; the _Total object is left out, and the average usage is the mean of the processors.
  • The first run has no interval yet: it is skipped. So is a run where a counter went backwards.
  • No processor at all, or an answer that is not the expected JSON, stops the collector as misconfigured: never a green light without a measure.

Nothing is written to the Windows: the command only reads.

Prerequisites

  • The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
  • The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
  • Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
  • An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
  • The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
  • The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).

Outputs

NameLabelUnitPer instance
cpu-busyOverall processor usage%no
privilegedKernel time%no
core-busyProcessor usage%yes, per processor (cpu0, cpu1…)
coresNumber of processors—no

Watches

NameTitleKindDefaultsChecked by default
cpu-highProcessor saturatedabove a threshold, on cpu-busywarning above 85 %, critical above 95 %, for 3 runsyes
core-hotA processor saturatedabove a threshold, on core-busywarning above 95 %, for 3 runs; no criticalno
core-neglectedA processor left idledeviates from the others, on core-busywarning when a processor is more than 30 % below the median of the others; no criticalno
core-countUnexpected number of processorsexpected value, on coresno expected value: it raises nothing until one is set on the probeyes

"A processor left idle" judges nothing on a run that keeps fewer than three processors: with two, there is no "others" to speak of.

Limits

  • Values arrive from the second run on; a probe whose interval is long averages over it.
  • The processors are the logical ones: on a processor with two threads per core, each thread is one processor.
  • On a Hyper-V host, the counters of the host are those of its own partition, not those of its virtual machines.
  • Not yet checked on a real Windows: the names of the Processor object on a machine of more than 64 logical processors, spread over several processor groups.
  • PowerShell starts at each run: about a second of processor time on the target, counted in the measure of that run.