Yep, which makes alerting about it a bit problematic. We also often see "Packet retransmission rate for process Windows System on host asdf has increased to 10 %". Seems like the best option is to just suppress these alerts, because there's nothing you can do with that information. ...Or if someone has ideas, do let me know 🙂
There is a way to figure out which processes are include under windows system from SA.
Go to diagnostic files --> Agent --> logs --> os and open processesSnapshot.log
In this file look for Group name: Windows System, under it you will find all the windows processes that OA collect together.
You will see for each process last CPU val and Virtual memory peak size and can get a clue on which process is consuming more CPU and Memory than others.
To get a process snapshot you can enable automatic process snapshots that run based on any of these triggering events or you can run a snapshot manually by selecting ... in the Process Snapshots section on a specific host page.