The "ELM 411" - Setting up Process Monitoring
The Process Monitor in ELM Enterprise Manager (and ELM Performance Manager) monitors Windows processes when assigned to an Agent. The Process Monitor is multi-functional; it can notify you when a process has exceeded the threshold of CPU usage you specify and it can track when processes are started or terminated. In addition, it can generate a Warning or Error when the number of instances of a process exceeds your specified value.
Processes
Each Process Monitor item supports multiple match criteria. Use the Add button to add a match criterion. Use the Delete button to remove a listed match criterion. You can also double-click any listed item to edit it. You may use the asterisk (*) as a wildcard character, a pipe (|) as an OR operator, the ampersand (&) as an AND operator, and the exclamation point (!) as a NOT operator. Starting with ELM 5.5, process names can be entered on separate lines for exclusion so they are easier to read.

Thresholds
There are two monitoring options with thresholds. These include CPU Usage and Number of Processes With The Same Name.
CPU Usage
High CPU is the most typical use for the Process Monitor. This next screen shows where you can modify the thresholds according to your needs.
- Warning when % Processor Time is greater than - Executes the enabled CPU Warning Actions when the CPU utilization of a monitored process exceeds the value.
- Error when % Processor Time is greater than - Executes the enabled CPU Error Actions when the CPU utilization of a monitored process exceeds the value.

Often times the CPU Usage monitor is used in conjunction with the Run Command action to kill a process out of control, then even restart it.

Number of Processes With The Same Name
- Warning when the number is greater than - Executes the enabled Process Count Warning Actions when the number of processes with the same name exceeds the value.
- Error when the number is greater than - Executes the enabled Process Count Error Actions when the number of processes with the same name exceeds the value.
As old as they are, sometimes a simple batch file is all that's needed. They're typically setup with a Windows Schedule Task, and run each day. If there's a problem, then after several days you have several orphan cmd.exe processes, and in no time these processes pile-up, taking system resources. The 'Process Count' Warning and Error will let you know when many duplicate processes are found.
Hidden Benefit
Finally, one of the "hidden" benefits of the Process Monitor is 'New Process' and 'Process Ended' monitoring. A new process could be a rogue process, and a missing process could mean users without a resource. The appearance of a new process with an unrecognized name, or the disappearance of an anti-virus process may not tax the CPU, but could indicate a serious condition.

We hope that you found this article informative and wish you continued success with your ELM deployment!
NOTE: All ELM 411 articles are written based on ELM Version 5.5 and instructions may not be accurate for previous ELM Versions. If you would like assistance upgrading to ELM 5.5 so you can use these tips - please contact support@tntsoftware.com.
Share your own ELM tips!
Have a tip or trick with our ELM products you'd like to share with our newsletter subscribers? Send your ideas and any applicable screen shots to info@tntsoftware.com with "ELM 411" in the subject line. We'll take a look and if usable you'll see it published here in the ELM 411 section of upcoming newsletters!