TOP N processes (System process metrics)

Elastic Observability Metrics
1

Hi,
I have a question concerning the system metrics field system.process.cpu.total.norm.pct described as "The percentage of CPU time spent by the process since the last event. This value is normalized by the number of CPU cores and it ranges from 0 to 100%"

Let's assume I set the "Process Include Top N by CPU"-Value in the System process metrics to 15 with a period of 60s.
How does Elastic Agent / Agentbeat calculate the Top 15 in that case?
Does it maintain a table with all the processes and their PIDs and after 60s it calculates the sum of CPU time spent by EVERY process then picks the Top 15 of those?

Thank you very much for some explanations & insights!

2

Hi Fabian

Elastic Agent does not maintain a table for 60 seconds and then calculate the sum for all processes.

At every collection interval (in your example 60s), the System integration:
. Reads the CPU counters for all running processes from the OS.
. Calculates the CPU usage delta since the previous collection for each process.
. Normalizes the value by the number of CPU cores (system.process.cpu.total.norm.pct).
. Sorts the processes by CPU usage.
. Keeps and sends only the Top N processes (Top 15 in your example).

So the Top N selection happens at each collection cycle, based on the CPU usage between the last two samples, not on an accumulated table over the whole 60-second window.

1 Like