Version

Argent Guardian Ultra — All Versions

Date

Updated Fri, 13 Mar 2015

Summary

There are two ways that Argent monitors CPU usage for Linux machines.

Depending on which pre-defined Rule you are using, the method of obtaining CPU usage may be different.

This KBI goes through the logic used in each type of script.

Technical Background

SCP_LINUX_CPU_OVERLOAD

In SCP_LINUX_CPU_OVERLOAD, Argent uses the ‘ps’ command to retrieve every process (using the -e switch) with the % CPU usage(-o pcpu) for each process on the Linux system.

The command also returns the Process ID (PID), and the command line for each process.

ps -e -o pid,pcpu,comm

The Rule checks if the CPU Total exceeds the predefined threshold CPU percentage.

The CPU Total is obtained by iteratively summing up the CPU usage of each process.

SCP_LINUX_PDT_CPU_UTIL

In SCP_LINUX_PDT_CPU_UTIL, Argent uses the ‘vmstat’ command to retrieve CPU utilization for the system.

vmstat 1 2 | awk ‘ { if ( NR == 4 ) print $NF } ‘

The script will subtract the idle (“id”) column from 100% to obtain the system’s CPU usage:

METRIC=`expr 100 – $CPU_IDLE`

• us: Time spent running non-kernel code.
• sy: Time spent running kernel code.
• id: Time spent idle.
• wa: Time spend waiting for IO.
• st: Time stolen from a virtual machine.

If values seem to be off, the Idle CPU (id) may be on a different column than what the script is expecting.

Argent can assist customers to update the script as long as the customer can provide a screenshot of the output of the command “vmstat 1 2” when executed on the target server (either through SSH or Telnet)

Resolution

N/A