Use Case: Keep an Eye on a Process

This short use case describes how you can use PerformanceGuard event management to monitor resource consumption on your organization's computers. It takes you through the following tasks in PerformanceGuard Central:

• Set up event rules
• View information about occurred events
   What's an event?

  An event is something that has taken place on an individual computer or server. Events typically relate to a threshold value that's exceeded so that performance is no longer considered acceptable. For example, your organization may set up an event to occur if CPU usage on a computer exceeds 95%. The event then serves as an indication of a problem, and by viewing details about the event you can investigate and solve the problem.

John, the IT systems manager at a hospital, uses PerformanceGuard to detect and alert him of processes that consume excessive resources on the organization's computers.

Today, John has a new process that he wants to keep an eye on: The process xyzproxy.exe, used in some of the organization's network security software, reputedly uses more and more computer resources over time. John wants to be informed in case the process uses more than more than 90% CPU resources on any of the hospital's computers.

In the PerformanceGuard web interface, John sets up two sets of event rules, alert rules and notification rules:

• One set that'll notify John by e-mail with the severity level Informational if the process uses between 90-95% CPU resources on any computer for more than three minutes.
• The other set is identical to the first one, except that it covers the interval 95-100% CPU resources and has the severity level Warning.

Now John will get notified with the severity Informational if the process begins to use more than 90% CPU resources for more than three minutes on any computer in the organization. Likewise, he will get notified with the severity Warning if the process uses more than 95% CPU resources.

Later that day, John gets six e-mail notifications with the severity Informational, and some minutes later he also gets a notification with the severity Warning.

When John opens the e-mails to view details about the occurred events, he sees that it's indeed the xyzproxy.exe process that has begun to consume excessive CPU resources on some computers.

John now opens the PerformanceGuard web interface and selects REPORTING > Events to view a list of occurred events with links to the locations and specific computers that experienced the problem. He now knows exactly where to take action.

If required, he can continue to monitor the events for some weeks or months to verify if the theory that xyzproxy.exe uses more and more CPU over time is correct.