Windows Processes Test

The Windows Processes test reports additional statistics pertaining to processes running on Microsoft Windows systems.

Target of the test : A Windows host

Agent deploying the test : An internal agent

Outputs of the test : One set of results per process pattern specified

Parameter	Description
Test Period	How often should the test be executed
Host	The host for which the test is to be configured.
Port	The port to which the specified host listens
Process	In the Process text box, enter a comma separated list of names:pattern pairs which identify the process(es) associated with the server being considered. processName is a string that will be used for display purposes only. processPattern is an expression of the form - expr or expr or expr or expr or expr1expr2... or expr1expr2, etc. A leading '' signifies any number of leading characters, while a trailing '' signifies any number of trailing characters. For example, to monitor the Word and Powerpoint applications on a system, in the PROCESS text box, enter officeProcess:winword,power, where * denotes zero or more characters. To save the time and effort involved in such manual process specification, eG Enterprise offers an easy-to-use auto-configure option in the form of a View/Configure button that is available next to the PROCESS text box. Refer to SectionAuto-configuring the Process Patterns to be Monitored of this document o know how to use the auto-configure option.
Wide	On Windows environments, by default, the eG agent uses perfmon to search for the processes that match the configured patterns. Accordingly, the wide parameter is set to false by default. Typically, a process definition in Windows includes the full path to the process, the process name, and process arguments (if any). Perfmon however scans the system only for process names that match the configured patterns – in other words, the process path and arguments are ignored by perfmon. This implies that if multiple processes on a Windows host have the same name as specified against process, then perfmon will only be able to report the overall resource usage across all these processes; it will not provide any pointers to the exact process that is eroding the host’s resources. To understand this better, consider the following example. Typically, Windows represents any Java application executing on it as java.exe. Say, two Java applications are executing on a Windows host, but from different locations. If java.exe has been configured for monitoring, then by default, perfmon will report the availability and average resource usage of both the Java applications executing on the host. If say, one Java application goes down, then perfmon will not be able to indicate accurately which of the two Java applications is currently inaccessible. Therefore, to enable administrators to easily differentiate between processes with the same name, and to accurately determine which process is unavailable or resource-hungry, the eG agent should be configured to perform its process searches based on the process path and/or process arguments, and not just on the process name – in other words, the eG agent should be configured not to use perfmon. To achieve this, first, set the WIDE parameter to Yes. This will instruct the eG agent to not use perfmon to search for the configured process patterns. Once this is done, then, you can proceed to configure a PROCESSPATTERN that includes the process arguments and/or the process path, in addition to the process name. For instance, if both the Remote Access Connection Manager service and the Terminal Services service on a Windows host, which share the same name – svchost - are to be monitored as two different processes, then your PROCESSPATTERN specification should be as follows: Terminal:C:\WINDOWS\System32\svchost-k DcomLaunch,Remote:C:\WINDOWS\system32\ svchost.exe-knetsvcs You can also use wildcard characters, wherever required. For instance, in the above case, your PROCESSPATTERN can also be: Terminal:svchost -k DcomLaunch,Remote:svchost.exe -k netsvcs Similarly, to distinctly monitor two processes having the same name, but operating from different locations, your specification can be: JavaC:c:\javaapp\java.exe,JavaD:d:\app\java.exe Note: Before including process paths and/or arguments in your processpattern configuration, make sure that the wide parameter is set to true. If not, the test will not work. If your processpattern configuration includes a process path that refers to the Program Files directory, then make sure that you do not include a ~ (tilde) while specifying this directory name. For instance, your processpattern specification should not be say, Adobe:C:\Progra~1\Adobe\AcroRd32.exe
Detailed Diagnosis	To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled: The eG manager license should allow the detailed diagnosis capability Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.

Measurements made by the test
Measurement	Description	Measurement Unit	Interpretation
Number of processes running	Indicates the number of processes that are currently running.	Number
Handle count	Indicates the number of handles opened by the process.	Number	An increasing trend in this measure is indicative of a memory leak in the process.
Number of threads	Indicates the number of threads that are used by the process.	Number
Virtual memory used	Indicates the amount of virtual memory that is being used by the process.	MB
I/O data rate	Indicates the rate at which processes are reading and writing bytes in I/O operations.	Kbytes/Sec	This value counts all I/O activity generated by each process and includes file, network and device I/Os.
I/O data operations	Indicates the rate at which the process is issuing read and write data to file, network and device I/O operations.	Operations/Sec
I/O read data rate	Indicates the rate at which the process is reading data from file, network and device I/O operations.	Kbytes/Sec
I/O write data rate	Indicates the rate at which the process is writing data to file, network and device I/O operations.	Kbytes/Sec
Page fault rate	Indicates the total rate at which page faults are occurring for the threads of all matching processes.	Faults/Sec	A page fault occurs when a thread refers to a virtual memory page that is not in its working set in main memory. This may not cause the page to be fetched from disk if it is on the standby list and hence already in main memory, or if it is in use by another process with whom the page is shared.
Memory working set	Indicates the current size of the working set of a process.	MB	The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed they will then be soft-faulted back into the Working Set before leaving main memory. If a process pattern matches multiple processes, the memory working set reported is the sum of the working sets for the processes that match the specified pattern. Detailed diagnosis for this test provides details of the individual processes and their individual working sets. Comparing the working set across processes indicates which process(es) are taking up excessive memory. By tracking the working set of a process over time, you can determine if the application has a memory leak or not.