# CPU usage does not match the CPU usage in Task Manager **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [January 10, 2019, 3:51pm UTC](https://discuss.elastic.co/t/cpu-usage-does-not-match-the-cpu-usage-in-task-manager/163776 "2019-01-10T15:51:29Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![zaeemshah](https://avatars.discourse-cdn.com/v4/letter/z/bbe5ce/32.png) [@zaeemshah](https://discuss.elastic.co/u/zaeemshah)\ **Post date:** [January 10, 2019, 3:51pm UTC](https://discuss.elastic.co/t/cpu-usage-does-not-match-the-cpu-usage-in-task-manager/163776/1 "2019-01-10T15:51:29Z")
Hi, I have just downloaded metricbeat and have successfully shipped the stats over to a third party elk saas provider. I have purposely spiked my CPU using Cpustress tool and it is remaining constantly above 85%-100% range but the stats shipped do not reflect this. system.cpu.system.norm.pct shows a different value system.cpu.total.norm.pct shows a different value I have looked everywhere and cannot seem to find a solution. Ideally i need to create a gauge on the back of it but seems like the cpu stats i see on Taks manager does not reflect on kibana ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/8/88ed5609ce80a38ce45a3703f009ca4599a9ea5b.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e51f9f7b6878d274cc291ed41b6a97111f043595.png) system.yml filew below # Module: system # Docs: [https://www.elastic.co/guide/en/beats/metricbeat/6.5/metricbeat-module-system.html](https://www.elastic.co/guide/en/beats/metricbeat/6.5/metricbeat-module-system.html) - module: system period: 1s metricsets: - cpu #- load #- memory #- network #- process #- process\_summary #- core #- diskio #- socket cpu.metrics: ["percentages", "normalized\_percentages"] # The other available options are normalized\_percentages and ticks. # process.include\_top\_n: # by\_cpu: 5 # include top 5 processes by CPU # by\_memory: 5 # include top 5 processes by memory #- module: system # period: 1m #metricsets: # - filesystem # - fsstat #processors: # - drop\_event.when.regexp: # system.filesystem.mount\_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)' #- module: system # period: 15m # metricsets: ``` #- uptime ``` #- module: system # period: 5m # metricsets: # - raid # raid.mount\_point: '/' Sample Log File below | 2019-01-10T18:08:33.122Z | INFO | [monitoring] | log/log.go:144 | Non-zero metrics in the last 30s | {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":4000},"total":{"ticks":94156,"time":{"ms":469},"value":94156},"user":{"ticks":90156,"time":{"ms":469}}},"handles":{"open":252},"info":{"ephemeral\_id":"b824d11a-326a-46d4-82ed-a482c65045f6","uptime":{"ms":9123793}},"memstats":{"gc\_next":8069712,"memory\_alloc":4053768,"memory\_total":9019312424}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":29,"batches":17,"total":29},"read":{"bytes":595},"write":{"bytes":10163}},"pipeline":{"clients":2,"events":{"active":1,"published":30,"total":30},"queue":{"acked":29}}},"metricbeat":{"system":{"cpu":{"events":30,"success":30}}}}}} | | --- | --- | --- | --- | --- | --- | | 2019-01-10T18:09:03.125Z | INFO | [monitoring] | log/log.go:144 | Non-zero metrics in the last 30s | {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":4015,"time":{"ms":15}},"total":{"ticks":94390,"time":{"ms":234},"value":94390},"user":{"ticks":90375,"time":{"ms":219}}},"handles":{"open":254},"info":{"ephemeral\_id":"b824d11a-326a-46d4-82ed-a482c65045f6","uptime":{"ms":9153794}},"memstats":{"gc\_next":8070288,"memory\_alloc":5598792,"memory\_total":9044014912}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":30,"batches":16,"total":30},"read":{"bytes":560},"write":{"bytes":9932}},"pipeline":{"clients":2,"events":{"active":1,"published":30,"total":30},"queue":{"acked":30}}},"metricbeat":{"system":{"cpu":{"events":30,"success":30}}}}}} | | 2019-01-10T18:09:33.125Z | INFO | [monitoring] | log/log.go:144 | Non-zero metrics in the last 30s | {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":4015},"total":{"ticks":94671,"time":{"ms":281},"value":94671},"user":{"ticks":90656,"time":{"ms":281}}},"handles":{"open":254},"info":{"ephemeral\_id":"b824d11a-326a-46d4-82ed-a482c65045f6","uptime":{"ms":9183794}},"memstats":{"gc\_next":5119392,"memory\_alloc":7105288,"memory\_total":9070225936,"rss":4096}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":31,"batches":17,"total":31},"read":{"bytes":595},"write":{"bytes":10610}},"pipeline":{"clients":2,"events":{"active":0,"published":30,"total":30},"queue":{"acked":31}}},"metricbeat":{"system":{"cpu":{"events":30,"success":30}}}}}} | | 2019-01-10T18:10:03.122Z | INFO | [monitoring] | log/log.go:144 | Non-zero metrics in the last 30s | {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":4015},"total":{"ticks":94686,"time":{"ms":15},"value":94686},"user":{"ticks":90671,"time":{"ms":15}}},"handles":{"open":252},"info":{"ephemeral\_id":"b824d11a-326a-46d4-82ed-a482c65045f6","uptime":{"ms":9213792}},"memstats":{"gc\_next":7309472,"memory\_alloc":4081336,"memory\_total":9096439616}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":30,"batches":17,"total":30},"read":{"bytes":595},"write":{"bytes":10358}},"pipeline":{"clients":2,"events":{"active":0,"published":30,"total":30},"queue":{"acked":30}}},"metricbeat":{"system":{"cpu":{"events":30,"success":30}}}}}} | ---
**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\ **Post date:** [January 11, 2019, 5:37pm UTC](https://discuss.elastic.co/t/cpu-usage-does-not-match-the-cpu-usage-in-task-manager/163776/2 "2019-01-11T17:37:47Z")
The metricbeat system module should use [GetSystemTimes](https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-getsystemtimes) instead of [NtQuerySystemInformation](https://docs.microsoft.com/en-us/windows/desktop/api/winternl/nf-winternl-ntquerysysteminformation) for calculating cpu usage. Or using performance counters. As a workaround you could create following windows module ```auto - module: windows metricsets: ["perfmon"] enabled: true period: 1s perfmon.counters: - instance_label: processor.time measurement_label: processor.time.total.pct query: '\Processor(_Total)\% Processor Time' ``` and check if the value match with the one from taskmanager. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 8, 2019, 5:37pm UTC](https://discuss.elastic.co/t/cpu-usage-does-not-match-the-cpu-usage-in-task-manager/163776/3 "2019-02-08T17:37:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.