processes by user running, linux

[Michael0]

Is there a way to monitor the processes which are running by all users seperate under linux systems?

proc.num isn´t helping me in this case because I have to specifiy the process name and/or username

proc.num[<name>,<user>,<state>,<cmdline>]

thanks for help!

[Pada]

Doesn't the manual give you enough information: https://www.zabbix.com/documentation...l/config/items

Example:
proc.num[,mysql] - number of processes running under user mysql
proc.num[apache2,www-data] - number of apache2 running under user www-data
proc.num[,oracle,sleep,oracleZABBIX] - number of processes in sleep state running under oracle having oracleZABBIX in its command line
On Windows, only name and user arguments are supported.

So by excluding a certain field, it won't filter that kind of data.

So if you want to get ALL the processes, use 'proc.num'

If this still does not answer your question, then perhaps give us a better idea of what info you're trying to obtain...

[steveboyson]

Take care as in current implementations (2.0.6) the Zabbix unix agent expects an EXISTING username.

If you specify an unknown user as a parameter to this item, the agent wil return "ZBX_UNSUPPORTED" rather then "0".

I take this as a bug.

[Michael0]

Thank you for your tipps!

My problem is, that I can´t specifiy any process or user name in the item.

I just want to get a statistic which process is running under which username on which day for how long etc...

Not sure if this is possible with zabbix?

[steveboyson]

So you want to get the process name with the user name which runs the procsess as results?
That cannot be done via builtin functions. You definitely need to do some coding.

First I thought of making a custom LLD discovery rule returning "processId" as itemindex and "username" and "runtime_seconds" as values.
But a LLD rule is not very clever since it expects items in a rarely changing matter. The minimum lifetime of a LL-dicovered item is "1 day". Keep in mind that process ids could be reused.

Most useable way would be to collect these data locally on the system and let zabbix just query the current/overall status. That involves a remarkable part of coding.

[Michael0]

So I found out that running processes by user is not the info what i needed...

So I tried an external script, which is looking for the CPU utilization for a specific user on the remote server:

ssh root@servername ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10 | grep <username> | cut -c 2-5

when I run this script on the zabbix server I get the value back:

--------------------------------------------------------------
S
E
C
U
R
I
T
Y

N
O
T
I
C
E
--------------------------------------------------------------
0.7

So the CPU utilization for the specific user is "0.7"

But when I create an item on the zabbix server with data type:
Numeric (float) its becoming unsupported: The received value is not suitable for value type Numeric (float)
When I choose "text" as data type, the item will stay as enabled, but without delivering any value back.

Not sure, but I think there is a problem with the Security Notice, because the script connects via ssh to the remote server

[steveboyson]

what about adding "| tail -1" to your ssh call?

[Michael0]

thanks for that hint, but the security notification stills pops up.

I´ve now done a workaround:

ssh root@servername ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10 | grep username | cut -c 2-5 > filename 2>&1

so the output will be written into "filename" then I use the item "vfs.file.contents" to look into the file for the value, which is working pretty good as I expected, but when no CPU utilization is triggered by this user, then the item becoming unsupported again, because its receiving no value :/

another strange thing is that I have configured the "refresh unsupported items" every 360s in the GUI zabbix frontend, but the items will not be enabled again...

[steveboyson]

How do you treat a result with multiple lines?

[Michael0]

thats another strange thing, in zabbix I get to correct value back e.g. 2.5% (CPU usage) without the security notification.

Looks like the securitiy banner, will only be displayed when running the shell script directly on the server

[steveboyson]

The security warning is probably sent to STDERR, not STDOUT thus it gets not displayed.

When I understand you correctly, you get the list of running processes sorted by cpu usage, take the first 10 lines thereof, search these for a specific username and spit out their current cpu usage (line by line)

How do you treat the possibility that a user has more than one process e.g. you get a multiline output:

ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10|grep www-data|cut -c 2-5
1.2
0.4
0.2
0.2
0.1

And wouldn't it be better to check for the username first and then strip it down to the first 10 entries?

I don't really understand what you're trying to achieve.