Use this Knowledge Script to monitor process memory usage. This script monitors individual memory use for each specified process, and the total memory use for all specified processes. If a process is not found, this script assumes that the process is not currently running, and reports 0 as the memory result.
You can use this script to monitor multiple processes with the same name, such as the process spawned by each instance of svchost.exe running on the same computer.
NOTE:
This script does not detect invalid process names. If you type an invalid process name, the script assumes that the process is not running, and reports 0 as the result.
This script raises an event if the memory usage for a named process exceeds the threshold, with one exception: the Windows System Idle process. The System Idle process indicates the percentage of idle CPU resources. If no applications are running, this process indicates a high idle capacity. The high percentage exceeds the threshold and raises an event indicating that the System Idle Process consumes high CPU resources. You can safely ignore this event message because the high percentage refers to the high idle capacity and not high CPU usage.
Windows 2003 Server or later
The default schedule for this script is Every 5 minutes.
Set the following parameters as needed:
Description |
How to Set It |
---|---|
Event Notification |
|
Create event for each process that exceeds the threshold? |
Select Yes to raise an event if the memory for an individual process exceeds the threshold you specify. The default is Yes. |
Severity - Individual process memory high |
Set the event severity level, from 1 to 40, to indicate the importance of an event in which individual process memory usage exceeds the threshold. The default is 8 (red event indicator). |
Create event if the sum of all processes exceeds the threshold? |
Select Yes to raise an event if the memory usage for all processes exceeds the threshold you specify. The default is Yes. |
Severity -- Total process memory high |
Set the event severity level, from 1 to 40, to indicate the importance of an event in which total process memory usage exceeds the threshold. The default is 15 (yellow event indicator). |
Severity -- Job failure |
Set the event severity level, from 1 to 40, to indicate the importance of an event in which the MemByProcess job fails unexpectedly. The default is 5 (red event indicator). |
Data Collection |
|
Collect data for each process? |
Select Yes to collect data for charts and reports. If enabled, data collection returns data for individual processes you are monitoring, including process name, memory utilization, and the memory utilization threshold you specified. The default is unselected. NOTE:If a process is not found, the script assumes that the process is not currently running, and reports 0 as the memory result. |
Collect data for all processes? |
Select Yes to collect data for charts and reports. If enabled, data collection returns data for all processes you are monitoring, including the process count, total memory utilization, and the memory utilization threshold you specified. The default is unselected. NOTE:If a process is not found, the script assumes that the process is not currently running, and reports 0 as the memory result. |
Monitoring |
|
Processes |
Provide one or more process names, separated by commas (,) without spaces. The default is explorer,lsass. NOTE:Under circumstances where multiple instances of a process are running on a computer (for example, svchost), Windows adds a number to each successive instance of the process beginning with the second instance (for example, svchost, svchost#1, svchost#2). You can monitor each process instance by entering the process name, including the added number. To see a list of distinct process names:
NOTE:The value of the Processes parameter must be an exact match (including case-sensitivity) of the process name in the Performance Object field of PerfMon. |
Maximum threshold for memory for each process |
Specify the maximum amount of memory each process can use before an event is raised. The default is 20000. Use the Memory scale parameter to define the threshold scale. |
Maximum threshold for memory for all processes |
Specify the maximum amount of memory all processes can use before an event is raised. The default is 32000. Use the Memory scale parameter to define the threshold scale. |
Memory scale |
Select the scale for the memory threshold you specify: bytes, kilobytes, megabytes, gigabytes, terabytes. The default is kilobytes. |