How does oneagent detects OS processes?

[hmor3]

Hi Guys,

what is the mechanism used by oneagent to detect processes in windows/Unix ?

Does it use tasklist for windows and ps interface for unix?

Thanks

Himanshu Mor

[Joe_Hoffman]

it hooks itself into the process creation event so as to see processes being created. But what use case requires this level of understanding? Perhaps there's something we can help with.

[hmor3]

Hello @Joseph M. H. , the use case is to Monitor OS level processes.

we need to understand what all types of process OneAgent will detect?

As part of schedules jobs , some processes run at specified times & duration of the day and we are not sure if all the processes are detected .

Also a simple test was performed by opening notepad.exe on a windows machine but it was not detected by the oneagent.

Details around system calls used/method of process detection will help

Thanks

Himanshu Mor

[Joe_Hoffman · Accepted solution]

All processes are detected, however not all processes are displayed. Only processes which consume a sufficient amount of resources are displayed. This helps keep the list of processes from being clogged with irrelevant processes. If you do a bunch of work in that Notepad process, I'll bet it will show up in a few minutes. But an idle notepad.exe is certainly not resource relevent.

[hmor3]

Thanks Joseph ! this helps and answers my concern.

Can we have this documented as part of Dynatrace documentation something like below topic ::

"How does dynatrace detects and displays processes"

[hmor3]

For everyone's reference , as mentioned by @Yos N. , below link explains the criteria that oneagent uses to detect and display processes :

https://www.dynatrace.com/support/help/shortlink/process-tracking#which-are-the-most-important-proce...

Thanks

Himanshu Mor

[Julius_Loman]

As far as I know, the built-in rules check for processes listening on a network socket. So If you need to monitor processes not listening on a network socket, you will need to setup the "Custom process group detection rules" and specify the executable name and path.

[gilgi]

So this means that if there is a bacground process that may consume cpu from time to time and create spikes, but doesn't do any networking activity, it will not automatically be detected ?

[Joe_Hoffman]

Gil, I ran a test using JDiskReport, which is a standalone desktop app, no network activity, but plenty of CPU and Disk activity. Dynatrace reported this process successfully, including the CPU consumption as it was significant.

So I think you should be fine. No network activity appears to be required as long as they're some significant resource consumption.

[Yosi_Neuman]

Hi,

here it is from: https://www.dynatrace.com/support/help/shortlink/process-tracking#which-are-the-most-important-processes

[hmor3]

Hello @Yos N. ,

Many thanks for your reply here as this is the required documentation link i was looking for and it mentions all criteria that dynatrace uses to detect the process at OS level.

Thanks

Himanshu Mor

[gilgi]

Hi All,

as we now understand how processes are displayed, look at this screen shot:

CPU is at 100%, but no process is showing a major contribution to this spike. We know that the guilty process has not been marked to be monitored as it does not run any code, so the automatic settings play here. the thing is that this process spikes its CPU but not enough to match this rule probably.

What's the play here to identify the guilty process in such as a case ?

Gil.

[Joe_Hoffman]

Gil, I have seen your symptoms previously, where the host CPU is very busy, but no processes show any relevant CPU activity level. The reason for this was due to a condition where processes were quickly being created/run/destroyed. So each process that was contributing to the overall CPU consumption was itself not significant.

I believe the workaround to this was to create a Process Group and then it showed up. But I'm not positive on that solution.

Does this possibly match your situation?