banshee/windows-collection/windows/winrm/processes

Processes of a Windows, by WinRM

Returns the number of processes of a Windows and, for each process name followed, the number of its instances, their memory and their processor time. Four watches are proposed, each one set on the probe.

How it works

The collector runs one PowerShell script, by WinRM, that reads Win32_Process, one object per process:

[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -InputObject @(Get-CimInstance Win32_Process | Select-Object Name, ProcessId, WorkingSetSize, KernelModeTime, UserModeTime)

WinRM hands the script to PowerShell itself: no shell stands in between, and the script is the one of windows/ssh/processes, without the powershell -Command "…" that cmd.exe needs there. The default shell of an OpenSSH server does not matter here.
A process is named by the name of its program, .exe included (lsass.exe, sqlservr.exe); the instances of one name add up.
The memory is the working set (WorkingSetSize, in bytes), returned in MiB.
The processor time is KernelModeTime plus UserModeTime, in hundreds of nanoseconds since each process started; its rate between two runs is returned as a share of one processor. It comes from the second run on, and is missing for a run where an instance ended and the sum went backwards.
Process 0, "System Idle Process", is left out: its time is the idle time of the processors.
The output is written in UTF-8 without a byte order mark, so that a name outside ASCII reads right.
By default, only lsass.exe and services.exe are followed; add on the probe the processes to follow.
No process at all, or an answer that is not the expected JSON, stops the collector as misconfigured.

Nothing is written to the Windows: the script only reads.

Prerequisites

The WinRM service of Windows listening in HTTPS. The service runs by default on every Windows Server from 2012 on (on a desktop Windows, winrm quickconfig starts it), with an HTTP listener only; the HTTPS listener needs a certificate: - a certificate for server authentication in the store of the computer (Cert:\LocalMachine\My), bearing the name the poller connects to: issued by the authority of the company, or made on the server by New-SelfSignedCertificate -DnsName <name> -CertStoreLocation Cert:\LocalMachine\My from Windows Server 2012 R2 on (Windows Server 2012 does not have this command); - then the listener: winrm quickconfig -transport:https finds a certificate of an authority by itself, but refuses a self-signed one; the command that takes either, on every Windows from Server 2012 on, is winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="<name>";CertificateThumbprint="<thumbprint>"} in cmd.exe, the thumbprint being the one Windows shows for the certificate.
The Windows firewall open to the poller on TCP 5986, which creating the listener does not do: New-NetFirewallRule -DisplayName "WinRM HTTPS" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow in PowerShell. A listener on another port is set in protocol:winrm:port.
The certificate judged by the poller before the account is sent, by the TLS profile of the probe: issued by an authority the system of the poller knows, by an authority added in protocol:tls:authorities, or pinned in protocol:winrm:fingerprint, the way for a self-signed certificate; the pin is not needed when the Security settings trust the first WinRM fingerprint presented. The fingerprint is sha256: followed by the SHA-256 of the certificate in 64 lower-case hexadecimal characters; from a machine that reaches the port, openssl s_client -connect <name>:5986 </dev/null | openssl x509 -noout -fingerprint -sha256 prints it, in capitals, with colons to take off. A certificate whose name is not the address of the host is judged on the name set in protocol:tls:server-name.
NTLM authentication, which the WinRM service accepts as installed (Negotiate = true in winrm get winrm/config/service/auth): the password never travels, only an answer computed with it. A domain that refuses NTLM is not served.
Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
An account for monitoring, without administrator rights, local or of the domain, set in protocol:winrm:user (account, DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the local group "Remote Management Users", which opens WinRM to an account that is not an administrator. No other group: Win32_Process is open to any account, the details of a protected process aside (Limits).

Outputs

Name	Label	Unit	Per instance
`processes`	Number of processes	—	no
`instances`	Number of instances	—	yes, per process name
`memory`	Memory	MiB	yes, per process name
`cpu`	Processor time, as a share of one processor	%	yes, per process name

Watches

Name	Title	Kind	Defaults	Checked by default
`missing`	Process missing	expected instances, on `instances`	critical when `lsass.exe` or `services.exe` is missing; no warning	yes
`too-many`	Too many processes	above a threshold, on `processes`	no threshold: to set on the probe	no
`memory-high`	Memory of a process	above a threshold, on `memory`	no threshold: to set on the probe	no
`cpu-high`	Processor of a process	above a threshold, on `cpu`	warning above 90 %, for 3 runs; no critical	no

"Process missing" looks at every process returned, inside the selection or not.

Limits

A certificate of the listener that expires, or a pinned one that is renewed, stops every WinRM collector of the host: the network/tls/certificate collector of banshee/web-collection, deployed on port 5986, watches it.
A process that starts and ends between two runs is not seen.
The processor time of a process can exceed 100 %: it is a share of one processor, and a process may use several.
Each run starts its own PowerShell on the target, which is counted among the processes.
Not yet checked on a real Windows: the times and the memory of a protected process (lsass.exe among them) read by an account without administrator rights; that setting the output encoding is accepted where WinRM runs PowerShell without a console (a refusal is an error beside the answer, which still arrives, with a name outside ASCII possibly misread).