System.cpu.total.norm.pct different of the sum system.process.cpu.total.norm.pct

[Altamir_Dias]

Hello Guys,

I using a ELK STACK with version 7.7.1 and I'm testing metricbeat to enviroment observability, but when I need view data about CPU process the calcule not close.

Why system.cpu.total.norm.pct its not the same value of the sum (system.process.cpu.total.norm.pct) ?

[Altamir_Dias]

e.g:

[jsoriano (Jaime Soriano)]

Hey @Altamir_Dias,

Take into account that at least in your screenshot you are comparing the sum with the system percentage (system.cpu.system.norm.pct), that doesn't include user load. I think that you should compare with the total (system.cpu.total.norm.pct).

In any case I think that CPU arithmetic is a bit tricky Have you compared with the results of top for example?

I have been looking at the values in a host and I see that:

• system.process.cpu.total.pct is quite similar to the values shown in the %CPU column per process.
• system.process.cpu.total.norm.pct is quite similar to the same column when showing normalized percentages (with shift+i).
• system.cpu.total.norm.pct is similar to the sum of user + system %Cpu(s) in the header.
• system.cpu.total.pct is similar to the previous value multiplied by the number of CPUs.
• The sum of %CPU of the top processes also doesn't match with the system-wide value.

Do you have similar results when comparing with top?

I guess that is difficult to take an snapshot of system-wide CPU usage, and all the values per process at the same moment so the sum of the values per process match with the total.

[Altamir_Dias]

Thanks for answear. I installed metricbeat with default configuration. My idea is show the monitoring team a real usage in real time of the resources in machine. With this visualization the team see what process is consuming more resource and don't will need access the serve to analise this cenario.

Regarding your question, I did several calculations but none closed the values. My perception is that this data is so volatile that the time between collections of the metricbeat makes it impossible for the data to be accurate.