banshee/windows-collection/windows/winrm/cpu

Processors of a Windows, by WinRM

Returns the usage of each logical processor of a Windows, the average usage of all of them, the share of time spent in kernel mode, and how many processors there are. Four watches are proposed, each one set on the probe.

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the WinRM service runs by default on every Windows Server from 2012 on, and winrm quickconfig starts it on a desktop Windows. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

The collector runs one PowerShell script, by WinRM, that reads the raw counters of Win32_PerfRawData_PerfOS_Processor, one object per logical processor:

ConvertTo-Json -Compress -InputObject @(Get-CimInstance Win32_PerfRawData_PerfOS_Processor | Select-Object Name, PercentProcessorTime, PercentPrivilegedTime, Timestamp_Sys100NS)

WinRM hands the script to PowerShell itself: no shell stands in between, and the script is the one of windows/ssh/cpu, without the powershell -Command "…" that cmd.exe needs there. The default shell of an OpenSSH server does not matter here.
PercentProcessorTime counts, despite its name, the idle time of the processor, and PercentPrivilegedTime its time in kernel mode, both in hundreds of nanoseconds since boot; Timestamp_Sys100NS is the clock they are read against. The usage over the interval is 1 − idle / clock, from the differences between two runs: exact, whatever the duration of the WinRM call.
The raw counters, not the formatted ones (Win32_PerfFormattedData_*): a formatted percentage needs two samples taken by the same process, and each run starts a new PowerShell.
The names of the classes and counters are English whatever the language of Windows, where the paths of Get-Counter are translated.
Each processor is named cpu0, cpu1… after the number Windows gives it; the _Total object is left out, and the average usage is the mean of the processors.
The first run has no interval yet: it is skipped. So is a run where a counter went backwards.
No processor at all, or an answer that is not the expected JSON, stops the collector as misconfigured: never a green light without a measure.

Nothing is written to the Windows: the script only reads.

Prerequisites

The WinRM service of Windows listening in HTTPS. The service runs by default on every Windows Server from 2012 on (on a desktop Windows, winrm quickconfig starts it), with an HTTP listener only; the HTTPS listener needs a certificate: - a certificate for server authentication in the store of the computer (Cert:\LocalMachine\My), bearing the name the poller connects to: issued by the authority of the company, or made on the server by New-SelfSignedCertificate -DnsName <name> -CertStoreLocation Cert:\LocalMachine\My from Windows Server 2012 R2 on (Windows Server 2012 does not have this command); - then the listener: winrm quickconfig -transport:https finds a certificate of an authority by itself, but refuses a self-signed one; the command that takes either, on every Windows from Server 2012 on, is winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="<name>";CertificateThumbprint="<thumbprint>"} in cmd.exe, the thumbprint being the one Windows shows for the certificate.
The Windows firewall open to the poller on TCP 5986, which creating the listener does not do: New-NetFirewallRule -DisplayName "WinRM HTTPS" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow in PowerShell. A listener on another port is set in protocol:winrm:port.
The certificate judged by the poller before the account is sent, by the TLS profile of the probe: issued by an authority the system of the poller knows, by an authority added in protocol:tls:authorities, or pinned in protocol:winrm:fingerprint, the way for a self-signed certificate; the pin is not needed when the Security settings trust the first WinRM fingerprint presented. The fingerprint is sha256: followed by the SHA-256 of the certificate in 64 lower-case hexadecimal characters; from a machine that reaches the port, openssl s_client -connect <name>:5986 </dev/null | openssl x509 -noout -fingerprint -sha256 prints it, in capitals, with colons to take off. A certificate whose name is not the address of the host is judged on the name set in protocol:tls:server-name.
NTLM authentication, which the WinRM service accepts as installed (Negotiate = true in winrm get winrm/config/service/auth): the password never travels, only an answer computed with it. A domain that refuses NTLM is not served.
Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
An account for monitoring, without administrator rights, local or of the domain, set in protocol:winrm:user (account, DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the local group "Remote Management Users", which opens WinRM to an account that is not an administrator. Also a member of "Performance Monitor Users": the collector reads performance counters, which Windows refuses outside this group to a WinRM session, a network logon.

Outputs

Name	Label	Unit	Per instance
`cpu-busy`	Overall processor usage	%	no
`privileged`	Kernel time	%	no
`core-busy`	Processor usage	%	yes, per processor (`cpu0`, `cpu1`…)
`cores`	Number of processors	—	no

Watches

Name	Title	Kind	Defaults	Checked by default
`cpu-high`	Processor saturated	above a threshold, on `cpu-busy`	warning above 85 %, critical above 95 %, for 3 runs	yes
`core-hot`	A processor saturated	above a threshold, on `core-busy`	warning above 95 %, for 3 runs; no critical	no
`core-neglected`	A processor left idle	deviates from the others, on `core-busy`	warning when a processor is more than 30 % below the median of the others; no critical	no
`core-count`	Unexpected number of processors	expected value, on `cores`	no expected value: it raises nothing until one is set on the probe	yes

"A processor left idle" judges nothing on a run that keeps fewer than three processors: with two, there is no "others" to speak of.

Limits

A certificate of the listener that expires, or a pinned one that is renewed, stops every WinRM collector of the host: the network/tls/certificate collector of banshee/web-collection, deployed on port 5986, watches it.
Values arrive from the second run on; a probe whose interval is long averages over it.
The processors are the logical ones: on a processor with two threads per core, each thread is one processor.
On a Hyper-V host, the counters of the host are those of its own partition, not those of its virtual machines.
Not yet checked on a real Windows: the names of the Processor object on a machine of more than 64 logical processors, spread over several processor groups; that "Performance Monitor Users" is the group a WinRM session needs for the counters.
PowerShell starts at each run: about a second of processor time on the target, counted in the measure of that run.