Kaseya Community

Can I monitor for any instance of a certain executable when it goes over a memory threshold?

This question is not answered

Here's my deal.  We have a software program that leaks memory.  There are many instances of it running on a Terminal Server, most instances behaving themselves.  But I need to watch for them to cross let's say 200MB of memory usage and when that happens, at minimum I need to generate an alert, but ultimately I'd like to fire off some process to alert the user and then terminate that process.  Can I do such a thing?

All Replies
  • I don't know about a monitor set, but I do know how to accomplish this with some command line kung-fu:

    tasklist /v /fi "imagename eq cmd.exe" /fi "memusage gt 204800"

    This returns cmd.exe (and the user running it) if it's using more than 200MB of memory.

    Put something like that in a script step "Execute Shell Command to Variable". Then check it in the next step with a conditional statement like "if contains cmd.exe" (true) send an email. Finally, schedule the script at your desired frequency.

    Notifying the user is the tricky part since this is a terminal server. (WMIC would be helpful in this case if it displayed the damn user name!) I'll try to figure something out since this is kind of fun.

  • You can create a monitor set with the object "process" and counter of "private bytes".  Choose the process you would like to monitor under Object


  • Scott, I am following you here right up to the point where I select the Instance.  The Term Servers run multiple instances of this executable, so when I get to the point where I have to select the instance, I have Operations#1, Operations#2....   Operations#43...  Operations.exe is the program I need to watch, but I can't understand how I get it to watch all instances and alert me when any of them exceed my memory limit.  In your example, right above where you're line is selected is multiple instances of "JobReader".  That's how my system looks with Operations, but as I said, I have dozens of it.  

    I had already taken the approach that SMason had mentioned, using the Tasklist command, and I am considering just modifying that procedure to use Taskkill to kill the runaway process, and I'll just schedule that procedure to run regularly on the machines in question, but I keep thinking this should really start with a monitor set and then have the monitor set call the procedure to kill the processes.