banshee/windows-collection/windows/ssh/processes

Processes of a Windows, by SSH

Returns the number of processes of a Windows and, for each process name followed, the number of its instances, their memory and their processor time. Four watches are proposed, each one set on the probe.

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the OpenSSH server is built in from Windows Server 2019 and Windows 10 1809, installed from Win32-OpenSSH before. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

The collector runs one PowerShell command that reads Win32_Process, one object per process:

powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -InputObject @(Get-CimInstance Win32_Process | Select-Object Name, ProcessId, WorkingSetSize, KernelModeTime, UserModeTime)"

A process is named by the name of its program, .exe included (lsass.exe, sqlservr.exe); the instances of one name add up.
The memory is the working set (WorkingSetSize, in bytes), returned in MiB.
The processor time is KernelModeTime plus UserModeTime, in hundreds of nanoseconds since each process started; its rate between two runs is returned as a share of one processor. It comes from the second run on, and is missing for a run where an instance ended and the sum went backwards.
Process 0, "System Idle Process", is left out: its time is the idle time of the processors.
The output is written in UTF-8 without a byte order mark, so that a name outside ASCII reads right.
By default, only lsass.exe and services.exe are followed; add on the probe the processes to follow.
No process at all, or an answer that is not the expected JSON, stops the collector as misconfigured.

Nothing is written to the Windows: the command only reads.

Prerequisites

The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).

Outputs

Name	Label	Unit	Per instance
`processes`	Number of processes	—	no
`instances`	Number of instances	—	yes, per process name
`memory`	Memory	MiB	yes, per process name
`cpu`	Processor time, as a share of one processor	%	yes, per process name

Watches

Name	Title	Kind	Defaults	Checked by default
`missing`	Process missing	expected instances, on `instances`	critical when `lsass.exe` or `services.exe` is missing; no warning	yes
`too-many`	Too many processes	above a threshold, on `processes`	no threshold: to set on the probe	no
`memory-high`	Memory of a process	above a threshold, on `memory`	no threshold: to set on the probe	no
`cpu-high`	Processor of a process	above a threshold, on `cpu`	warning above 90 %, for 3 runs; no critical	no

"Process missing" looks at every process returned, inside the selection or not.

Limits

A process that starts and ends between two runs is not seen.
The processor time of a process can exceed 100 %: it is a share of one processor, and a process may use several.
Not yet checked on a real Windows: the times and the memory of a protected process (lsass.exe among them) read by an account without administrator rights.