Kaseya Community

Create an Alert for a System Service/EXE Utilizing % amount of RAM

This question has suggested answer(s)

Kaseya Team,

Is it possible to create an Alert in the VSA if a process is utilizing too much RAM or CPU cycles? How would one go about creating that?

Thank you!

All Replies
  • It is possible, we have this set up in our system.  

    Monitor -> Edit -> Monitor Sets -> New Monitor Set

    Step 1: Set name and Description, click Save.  

    Step 2: Under Counter Thresholds, set the following:

    Object: Process

    Counter: % Processor Time (for CPU) or Working Set (for Memory)  - There are other memory types you can probably use but I prefer Working Set

    Instance: Your application should probably be listed, as this list seems populated from programs on the agents.  Proprietary software our company uses (and you won't ever find off the shelf) was already listed here.

    Set a Counter Name and click next.  

    Step 3 is your collection threshold, this is used for reporting purposes, and it can free up bandwidth as the agent will only upload data over/under the threshold to the server.  If you want it to collect everything, set the threshold to say, "Over 0" which any counter over 0 will get reported.  That can get intensive depending on the number of agents and the number of counters.

    Step 4: this is your actual alarm.  For % CPU, I set up a counter if an application uses more than 20% CPU for more than 3 minutes (my processes are extremely efficient so high CPU usage is a sign of a problem).  So your Alarm Operator is Over, Alarm Threshold is 0, Duration is 3 minutes, Ignore time is 1 hour.

    Step 5: Warnings are only used for dashboards/summaries I believe, they don't actually generate e-mails.  So I set this to something but it's not really needed.  

    Step 6: Trending is for linear trends to help predict recurring issues.  I've never played with this, everything is no.  

    Remember then to apply the Monitor Set you just created under Agent Monitoring -> Assign Monitoring or under Policy Management.  

    In my case, I applied these via policy by creating a view that looked for servers that had the application I wanted to monitor on them (in Views -> Edit go to Applications, check Contains and type in the name of the process, in my case I added a wildcard for say Skype* instead of Skype.exe).  Then I applied the monitor I just created using the view for servers who had that application.  This worked out really well for a product line of ours where some customers might have say, 3 monitored applications, but other customers might have 5, and I didn't want monitors looking for apps that didn't exist on those agents.  

    Hope this helps.

  • ,  I learn new things every day!  This is great, thanks for sharing!

  • What if it is a service that is taking X amount of memory? I see the service listed when I go to services check, but that looks like it restarts the service etc. not just alert and when I go to counter thresholds; it doesn't show up in that list of objects.


  • Hi atupeck,  I believe for services there's an option to select services instead of processes when designating the "Object" to be monitored in step 2.  

  • Thank you for sharing and contributing to the community

  • unless it's something that doesn't come with 9.5 out of the box, Services is not an Object option.

    You can however, just monitor the process that the service executes.  Just reverse engineer what executable is called by viewing the properties of the service in question within in the Windows itself (services.msc) & then resume with your original instructions

    [edited by: michaelha at 12:26 PM (GMT -7) on Aug 8, 2018]
  • @atupeck I have a monitor set to alert us when iexplore.exe memory utilization cross and stay 12% for 5 min

    You can import this to your VSA and apply to respective machine by going to "Assign Monitoring" tab.



    <monitor_set_definition version="1.0">

    <MonitorSet name="IE high usages" description='Monitor set to track memory usages above 12% and email alerts if usages remain there for 5 min.' enableCounterMatching='0'>


    <Counter name='%Memory Usages '  description='null' counterObject='Memory'  counter='% Committed Bytes In Use'  counterSampleInterval='60' collectionOperator='Over'  collectionThreshold='10' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Over'  thresholdAmount='12' thresholdDuration='300' thresholdWarning='11' thresholdReArm='3600'/>





    <Process name='iexplorer.exe'  processDescription='Internet Explorer' description='null' monitorDirection='Up'  reArm='300'/>





  • You can think outside the VSA...

    Windows PerfMon allows you to create very specific performance alerting configurations. When performance exceeds specific thresholds, it can create an event log entry. Simply create an event log monitor for this event.

    While VSA can do most of this out of the box, it isn't intuitive. PerfMon has a GUI that you can use to watch interactively to make sure you're selecting the best counters. Once you see you're getting what you need, you set the alerting option and wait for VSA to get the alerts. The advantage of this is that you can get a PerfMon log to see exactly what was happening on the system. You can actually log many different parameters but only trigger on a few, which might provide more insight into the performance issues than just basic monitoring might provide. This also has the advantage of seeing all of the objects available on a system without needing to scan/import into VSA, which can be helpful for ad-hoc monitoring.

    We have utilities that can deploy PerfMon logging using predefined sets for core and many common applications, start/stop and consolidate the logs into 24-hour segments, and prepare the data for analysis tools such as PAL.