Too many processes

[tikejhya]

Hi All,

I am in confusion with Too many processes running trigger with default zabbix linux template.

Alert
Too many processes running on mail.tikejhya.com: PROBLEM
Last value: 38

When i get this alert i am always in chasing game ofcourse to get the right result manually but i dont seem to get one, could you guys please provide me feedback what exactly zabbix will be looking for.

proc.num [,,run] = result doesnot seem to be equal to my manual below given tests,

ps -ef | awk '{ print $8 }' | sort -n | uniq -c | sort -n | tail -5
5 /sbin/mingetty
7 /usr/local/sbin/zabbix_agentd
44 /usr/local/php5/bin/php-cgi


ps aux | awk '{ print $11 }' | sort -n | uniq -c | sort -n

5 /sbin/mingetty
7 /usr/local/sbin/zabbix_agentd
44 /usr/local/php5/bin/php-cgi

Am i refering wrong here, or is that something else zabbix looks into, my understanding was zabbix will get the figure of TOP command, Tasks: xx Total x running (this running bit here).

Any feedback.
Regards
Tikejhya

[danrog]

You are correct, zabbix is pulling X from 'X of Y running' when using top (although it doesn't actually run top or ps to get its info, it uses /proc for most if not all of its data on a linux system).

Run 'ps aux | grep '[R]+'' to get just the list of running processes (side note, enclosing the first letter of a pattern in [] when using grep, will 'filter' the grep command - useful if you have older systems that don't have pgrep or other workarounds or just like grep).

Without looking at the code, if I had to guess, it might be pulling data from /proc/loadavg

man 5 proc

.....
       /proc/loadavg
              The first three fields in this file are load average figures giving the number  of  jobs  in  the  run  queue
              (state  R)  or  waiting  for disk I/O (state D) averaged over 1, 5, and 15 minutes.  They are the same as the
              load average numbers given by uptime(1) and other programs.  The fourth field consists of two  numbers  sepa-
              rated  by  a  slash  (/).  The first of these is the number of currently executing kernel scheduling entities
              (processes, threads); this will be less than or equal to the number of CPUs.  The value after  the  slash  is
              the  number  of kernel scheduling entities that currently exist on the system.  The fifth field is the PID of
              the process that was most recently created on the system.