Getting aggregated view of 100% CPU across all dashboard views for windows server

Elastic Stack Beats
1

Hi,

We have been trying to achieve a breakdown of the active CPU% distributed between all the active process. Here's an example: If we have 8CPU, we see the total will be 800% and the active process consumption goes above 100% which is not ideal.

Question about system.process.cpu.total.pct Question about system.process.cpu.total.pct says that windows is a discrepancy where metricbeat is not accurate.

image
image

Please help/clarify if this can be sorted.

Thanks
Mahesh

2

The post you linked to is kind of old. I believe that since then we made some changes. The system.process.cpu.total.norm.pct value ranges on 0 to 100%. You should be able to verify that by look at the individual events in a non-aggregated view (Discover tab) and doing a Lucene query like system.process.cpu.total.norm.pct:>=1.

What version of Metricbeat is being used?

3

Thanks AndreW. It is metricbeat 6.2.1 and still is going beyond 100%. Is there a possible way to put a calculation (system.cpu.total/no.of.cores) to get accurate values? Is system.cpu.total.pct should be considered for this? And, system.cpu.system.pct measure for?

4

I would consider it a bug if the normalized CPU metrics are going over 100%. Can you please open a bug report on Github for this issue and include a raw event in JSON form (you can grab that from Kibana's Discover page).

As a workaround, yes, it's definitely possible to do your own calculations. There is a system.cpu.cores metric which contains the total number of cores. With that value I think you should be able to do your own calculation.

You can do the calculation either at ingest time by using Logstash. Or you can add a scripted field to Kibana.

This is a filter example in LS that shows how you can do a calculation. (I'm not sure these calculations are relevant -- I just copied it from somewhere to demonstrate how it can be done.)

filter {
  ruby {
    code => "
      event.set('[system][cpu][total][norm][pct]', 1 - (event.get('[system][cpu][idle][pct]') / event.get('[system][cpu][cores]') ))
      event.set('[system][cpu][total][pct]', event.get('[system][cpu][total][norm][pct]') * event.get('[system][cpu][cores]') )
    "   
  }
}
5

Thanks Andrew, I see the normalized CPU is defined only for process by CPU. However, I wanted to understand if there is any defined normalized CPU for system/server?

image

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.