banshee/windows-collection/windows/ssh/memory

Memory of a Windows, by SSH

Returns the physical memory of a Windows: its size, the memory available, the memory used, and the share used, as Task Manager shows them. Two watches are proposed, each one set on the probe. The paging file is the collector windows/ssh/pagefile.

How it works

The collector runs one PowerShell command that reads Win32_OperatingSystem:

powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_OperatingSystem | Select-Object TotalVisibleMemorySize, FreePhysicalMemory | ConvertTo-Json -Compress"

TotalVisibleMemorySize is the physical memory Windows can use, FreePhysicalMemory the memory available, both in KiB, returned in MiB.
Available memory counts the standby cache, which Windows gives back to programs on demand: used memory is the rest, the figure Task Manager shows as "In use".
Nothing is skipped at the first run.
An answer that is not the expected JSON, or no physical memory, stops the collector as misconfigured: never a green light without a measure.

Nothing is written to the Windows: the command only reads.

Prerequisites

The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).

Outputs

Name	Label	Unit	Per instance
`total`	Physical memory	MiB	no
`used`	Used memory	MiB	no
`available`	Available memory	MiB	no
`used-percent`	Used memory	%	no

Watches

Name	Title	Kind	Defaults	Checked by default
`used-percent`	Memory saturated	above a threshold, on `used-percent`	warning above 90 %, critical above 95 %, for 3 runs	yes
`available`	Little memory available	below a threshold, on `available`	critical below 512 MiB; no warning	no

Limits

The memory is a moment, read once per run: a peak between two runs is not seen.
Not yet checked on a real Windows: that FreePhysicalMemory follows "Available" of Task Manager, standby cache included, as Microsoft documents it.