Yep, which makes alerting about it a bit problematic. We also often see "Packet retransmission rate for process Windows System on host asdf has increased to 10 %". Seems like the best option is to just suppress these alerts, because there's nothing you can do with that information. ...Or if someone has ideas, do let me know 🙂
One idea might be to look at the Windows logs at the host level in Dynatrace. Might find an indication of something that might be going on. Also, take a look at the number of DNS queries, as it has surprised me in some occasions.
There is a way to figure out which processes are include under windows system from SA.
Go to diagnostic files --> Agent --> logs --> os and open processesSnapshot.log
In this file look for Group name: Windows System, under it you will find all the windows processes that OA collect together.
You will see for each process last CPU val and Virtual memory peak size and can get a clue on which process is consuming more CPU and Memory than others.