Agent overhead
What the SparkLogs agent stack itself costs the host: CPU, working set and handles.
Topic id: agent_overhead.
This topic is still rolling out. Endpoints on the general release do not send it yet.
Conditions
A condition is a state that holds for a while. The agent opens it when the host enters it, keeps it open while it lasts, and closes it when the host comes back out, so one episode answers for the whole stretch instead of one alert per sample.
| Condition | Severity | How an episode ends |
|---|---|---|
agent cpu over budget (agent_cpu_over_budget) | Notice | It closes when the measurement falls back past its recovery point. |
agent handle over budget (agent_handle_over_budget) | Notice | It closes when the measurement falls back past its recovery point. |
agent ram over budget (agent_ram_over_budget) | Notice | It closes when the measurement falls back past its recovery point. |
Example
Inventory (every 15 minutes)
ws 62 MB, 1800 handles.
sparklogs.data.agent_overhead.row: agent
sparklogs.data.agent_overhead.handle_count_avg: 1800.0
sparklogs.data.agent_overhead.combined_working_set_avg_mb: 96.0
SparkLogs: CONTEXT, Info, agent_overhead: INVENTORY: ws 62 MB, 1800 handles.
Selected conditions
agent_cpu_over_budget
The agent stack is over CPU budget.
Impact: Monitoring overhead may be higher than expected on this host.
Example
started; component "agent" agent CPU of one core 145% (threshold 10%)
sparklogs.instance: component:agent
sparklogs.data.agent_overhead.row: agent
sparklogs.data.agent_overhead.cpu_pct_of_one_core_avg: 145.0
sparklogs.data.agent_overhead.agent_cpu_over_budget_age_h: 0.0
SparkLogs: agent_cpu_over_budget, Notice, agent_overhead: agent_cpu_over_budget: NOTABLE: started; component "agent" agent CPU of one core 145% (threshold 10%)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | rmm |
held | Trace to Fatal | rmm |
recovered | Trace to Fatal | rmm |
agent_handle_over_budget
The agent stack is over its handle budget.
Impact: Monitoring overhead may be higher than expected on this host.
Example
started; component "agent" agent handles 5160 (threshold 4000)
sparklogs.instance: component:agent
sparklogs.data.agent_overhead.row: agent
sparklogs.data.agent_overhead.handle_count_avg: 5160.0
sparklogs.data.agent_overhead.agent_handle_over_budget_age_h: 0.0
SparkLogs: agent_handle_over_budget, Notice, agent_overhead: agent_handle_over_budget: NOTABLE: started; component "agent" agent handles 5160 (threshold 4000)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | rmm |
held | Trace to Fatal | rmm |
recovered | Trace to Fatal | rmm |
agent_ram_over_budget
The agent stack is over memory budget.
Impact: Monitoring overhead may be higher than expected on this host.
Example
started; component "agent" agent working set 408 MB (threshold 350 MB)
sparklogs.instance: component:agent
sparklogs.data.agent_overhead.row: agent
sparklogs.data.agent_overhead.combined_working_set_avg_mb: 408.0
sparklogs.data.agent_overhead.agent_ram_over_budget_age_h: 0.0
SparkLogs: agent_ram_over_budget, Notice, agent_overhead: agent_ram_over_budget: NOTABLE: started; component "agent" agent working set 408 MB (threshold 350 MB)
| Case | Severity | Ticket class |
|---|---|---|
onset | Trace to Fatal | rmm |
held | Trace to Fatal | rmm |
recovered | Trace to Fatal | rmm |