Windows – perfmon – single thread utilizing max CPU – how to detect

cpu-usageperfmonwindows

I work as a windows server admin. Part of my work is to maintan servers and react to monitoring alerts which are often about high CPU load. Sometimes it happens that some app or process gets stuck in an infinite loop or something and uses 100% CPU but only one core/thread, so on a 4 cores system it makes total 25% CPU usage and no alert gets triggered although I would like to know if this kind of situation happens. I am thinking about ways of detecting this. It does not work just to setup threshold to 25% of CPU usage, because the sum of all processes running on a system easily gets over 25%, but this does not detect situation when only one process/thread is responsible for this. I found out that in performance monitor I can add \Process(process name)\% Processor Time and if a single process runs at max load and shows 12% in task manager on a core i7 (you can test it by re-encoding MP3s with LameXP for example) this counter will show you 100, so this works and would detect such process. The problem is that it will work only for processes already existing at the time of setting up of the counter. Even if you use All instances and start it, it will not show newly launched processes which is a problem. Is there any other performance counter or utility which would show this kind of situation?

EDIT: example
enter image description here

if I encode some big WAV file for example, I can set affinity of the lxp_lame.exe to not use all cores but only one and then yes – this powershell snippet will show 100 for that one core. If I don't do it, the process jumps between cores and there is never any high number.

Best Answer

Use the WMI processor performance counters. Exclude the counters with _Total, because those average the load.

Get-WMIObject -Class Win32_PerfFormattedData_Counters_ProcessorInformation |
  Where-Object {$_.Name -notmatch "total"} |
    Select-Object -Property Name,PercentIdleTime,PercentProcessorTime

You'll see something like this:

Name PercentIdleTime PercentProcessorTime
---- --------------- --------------------
0,0              100                    0
0,1               95                    4
0,2              100                    0
0,3               89                   10

I'll leave generating the alert up to you.