4.18 MemByProcess

Use this Knowledge Script to monitor process memory usage. This script monitors individual memory use for each specified process, and the total memory use for all specified processes. If a process is not found, this script assumes that the process is not currently running, and reports 0 as the memory result.

You can use this script to monitor multiple processes with the same name, such as the process spawned by each instance of svchost.exe running on the same computer.

NOTE:

  • This script does not detect invalid process names. If you type an invalid process name, the script assumes that the process is not running, and reports 0 as the result.

  • This script raises an event if the memory usage for a named process exceeds the threshold, with one exception: the Windows System Idle process. The System Idle process indicates the percentage of idle CPU resources. If no applications are running, this process indicates a high idle capacity. The high percentage exceeds the threshold and raises an event indicating that the System Idle Process consumes high CPU resources. You can safely ignore this event message because the high percentage refers to the high idle capacity and not high CPU usage.

4.18.1 Resource Objects

Windows 2003 Server or later

4.18.2 Default Schedule

The default schedule for this script is Every 5 minutes.

4.18.3 Setting Parameter Values

Set the following parameters as needed:

Description

How to Set It

Event Notification

Create event for each process that exceeds the threshold?

Select Yes to raise an event if the memory for an individual process exceeds the threshold you specify. The default is Yes.

Severity - Individual process memory high

Set the event severity level, from 1 to 40, to indicate the importance of an event in which individual process memory usage exceeds the threshold. The default is 8 (red event indicator).

Create event if the sum of all processes exceeds the threshold?

Select Yes to raise an event if the memory usage for all processes exceeds the threshold you specify. The default is Yes.

Severity -- Total process memory high

Set the event severity level, from 1 to 40, to indicate the importance of an event in which total process memory usage exceeds the threshold. The default is 15 (yellow event indicator).

Severity -- Job failure

Set the event severity level, from 1 to 40, to indicate the importance of an event in which the MemByProcess job fails unexpectedly. The default is 5 (red event indicator).

Data Collection

Collect data for each process?

Select Yes to collect data for charts and reports. If enabled, data collection returns data for individual processes you are monitoring, including process name, memory utilization, and the memory utilization threshold you specified. The default is unselected.

NOTE:If a process is not found, the script assumes that the process is not currently running, and reports 0 as the memory result.

Collect data for all processes?

Select Yes to collect data for charts and reports. If enabled, data collection returns data for all processes you are monitoring, including the process count, total memory utilization, and the memory utilization threshold you specified. The default is unselected.

NOTE:If a process is not found, the script assumes that the process is not currently running, and reports 0 as the memory result.

Monitoring

Processes

Provide one or more process names, separated by commas (,) without spaces. The default is explorer,lsass.

NOTE:Under circumstances where multiple instances of a process are running on a computer (for example, svchost), Windows adds a number to each successive instance of the process beginning with the second instance (for example, svchost, svchost#1, svchost#2). You can monitor each process instance by entering the process name, including the added number.

To see a list of distinct process names:

  1. From the Control Panel, double-click Administrative Tools and then double-click Performance.

  2. Click Add (+).

  3. From the Performance object list, select Process.

  4. Click Select instances from list and then scroll to find the process names.

  5. Click Add.

NOTE:The value of the Processes parameter must be an exact match (including case-sensitivity) of the process name in the Performance Object field of PerfMon.

Maximum threshold for memory for each process

Specify the maximum amount of memory each process can use before an event is raised. The default is 20000. Use the Memory scale parameter to define the threshold scale.

Maximum threshold for memory for all processes

Specify the maximum amount of memory all processes can use before an event is raised. The default is 32000. Use the Memory scale parameter to define the threshold scale.

Memory scale

Select the scale for the memory threshold you specify: bytes, kilobytes, megabytes, gigabytes, terabytes. The default is kilobytes.