Overview

This event monitor watches the processes running on remote machines. It can be set to check overall CPU and memory usage or to focus on specific processes to ensure they are running and aren't using too much CPU time or memory.

Use Cases

• Detecting processes that are consuming memory or CPU time in excess
• Monitoring the number of processes running at a given time

Monitoring Options

This event monitor provides the following options:

Alert With [Info/Warning/Error/Critical] if the Device Cannot Be Contacted

Use this option to get alerts if FrameFlow could not contact the selected device.

Alert based on the number of processes that are running

This option lets you specify the number of processes that will trigger each level of alert.

Alert based on total CPU usage

This option calculates the total CPU usage of all processes and alerts based on thresholds that you choose.

Alert if [any process|this process] is using more than a specified percent of CPU time

Use this option to get alerts about processes that are using the most CPU time. Or you can select to watch any individual process that you want to monitor.

Alert if total memory usage is more than a specified amount

This option measures the total amount of memory used by all processes and alerts you based on the thresholds that you choose.

Alert if [any process|this process] is using more than a specified amount of memory

Use this option to get alerts about the processes that are using the most memory. Or you can select to watch any individual process and alert about its memory usage.

Alert with [Info/Warning/Error/Critical] if specified processes are found to be running

Use this option to be notified if selected processes are running.

Alert with [Info/Warning/Error/Critical] if specified processes are found to be running

Process Names

Enter the names of the processes that the event monitor will look for. To get the exact name, use the option below to include a list of running processes in all notifications. To specify multiple processes, separate them with commas.

Only warn if more than [#] instances of a process are found

In some cases, it is normal to have a few instances of a specific process running but having too many of them can indicate a problem. Use this option to only get alerts if there are more than a certain number of instances of the same process running.

Alert with [Info/Warning/Error/Critical] if specified processes are not found to be running

If you have critical processes that must be running all the time, use this option to get alerts if they are not found. To specify multiple processes, separate them with commas.

Include a list of running processes in all notifications

When this option is selected the event monitor will include a list of all detected processes in each alert and notification. It's a great way to see and select the exact process names to be used in other settings for the event monitor.

Use WMI to retrieve the process data

By default, the event monitor uses Windows performance counters to collect the data it needs. Performance counters are the most reliable option; however, if the event monitor reports that it is unable to find the required counters you can enable this option to tell it to use Windows Management Instrumentation (WMI) instead.

SSH Port Number

The default port number of SSH connections is 22. If your servers are using a non-standard port you can specify it here.

Authentication and Security

PDH: The account used for authentication must be a member of the Performance Monitor Users group or have admin rights.`

WMI: The account used for authentication must be a member of the Performance Monitor Users group and the Distributed COM Users group, or have admin rights.

Protocols

WMI

Click on a protocol to learn more.

Data Points

This event monitor generates the following data points:

Data Point	Description
Process Count	The total number of processes running.
CPU Usage	The total CPU used, by percent.
Memory Usage	The percentage of total memory used.

Sample Output

Tutorial

To view the tutorial for this event monitor, click here.