Top processes

0readings

0conditions

0themes fed

Livestatus

Processes selected by CPU, resident and private memory, read/write I/O and TCP payload traffic, plus system CPU and an unlisted-process remainder.

Topic id: top_processes.

This topic reports what the host looks like rather than scoring a condition on it. The values it carries are queryable on their own.

Fields (21)

Processes selected by CPU, resident memory, private commit, read/write I/O and TCP payload received or sent, plus system CPU and a remainder for unlisted processes. TCP fields are absent without a matching measured window. Use emitted TCP rates: TCP accepted seconds can differ from process measured seconds.

Reported every 5 minutes on clock boundaries for the window ending at t. sparklogs.window_coverage_pct is below 100 when collection covered only part of the window. Use chart buckets at least 5 minutes wide.

sparklogs.window_measured_s gives the unrounded duration in seconds used to calculate this topic's rates. It counts accepted intervals only and is absent when none were accepted.

Process (7)

sparklogs.data.top_processes.pid

integer

The process ID. With create_time_ts, it identifies the process. Absent on system and remainder rows.

sparklogs.data.top_processes.create_time_ts

string · timestamp

When the process started, in UTC. Absent on system and remainder rows, which are not processes.

sparklogs.data.top_processes.image_name

string

The process's executable file name. On a system or remainder row, the row's name: (hardware interrupts), (deferred procedure calls) or (other processes).

sparklogs.data.top_processes.image_path

string

The full path of the process's executable. Absent when the agent could not read it while the process ran, and on system and remainder rows. The agent never collects command-line arguments.

sparklogs.data.top_processes.services

string_array

The Windows services this process hosts, sorted. Absent when it hosts none.

sparklogs.data.top_processes.entry_kind

string

What the row is: process for one listed process; system for CPU spent on hardware interrupts or deferred procedure calls (DPCs), with no memory or I/O fields; remainder for every process not listed. The remainder's CPU is the machine's busy time minus the other rows, never below 0; when the machine-wide CPU counters could not be read or disagree with the machine's processor count, the system rows are left out and the remainder's CPU is the sum of the unlisted processes.

CPU (2)

sparklogs.data.top_processes.cpu_busy_pct_avg

float · percent

Average CPU use over the 5-minute window, as a percentage of all logical cores. The System Idle Process is not listed.

sparklogs.data.top_processes.cpu_busy_pct_max_1m

float · percent

The highest one-minute CPU reading in the window, as a percentage of all logical cores.

Memory (4)

sparklogs.data.top_processes.resident_bytes

integer · bytes

Physical memory the process held at the end of the window, including pages shared with other processes. On the remainder row, the total for unlisted processes still running then. Absent on system rows and for a process that had exited by then. Adding this up across rows counts shared pages more than once.

sparklogs.data.top_processes.resident_pct_ram

float · percent

The row's resident memory as a percentage of installed RAM. Shared pages can make these add up to more than 100 across rows. Absent when resident_bytes is, or installed RAM was not read.

sparklogs.data.top_processes.private_resident_bytes

integer · bytes

Physical memory private to the process at the end of the window. On the remainder row, the total for unlisted processes, absent when any of them lacks a reading. Absent on system rows, for a process that had exited by then, and when Windows did not report it. The total across rows is not the machine's used RAM.

sparklogs.data.top_processes.private_commit_bytes

integer · bytes

Private memory the process had committed at the end of the window, including memory not currently in RAM (Task Manager's Commit size). On the remainder row, the total for unlisted processes still running then. Absent on system rows and for a process that had exited by then. It is not physical RAM use.

Disk I/O (4)

sparklogs.data.top_processes.read_bytes_5m

integer · bytes

Bytes the row's processes read over the 5-minute window ending at the event time, counting file, pipe, device and network reads. When only part of the window was measured, it covers only that part.

sparklogs.data.top_processes.write_bytes_5m

integer · bytes

Bytes the row's processes wrote over the 5-minute window ending at the event time, counting file, pipe, device and network writes. When only part of the window was measured, it covers only that part.

sparklogs.data.top_processes.read_mb_per_s_avg

float · megabytes_per_second

The average read rate over the measured part of the window, counting all process reads, not only disk reads.

sparklogs.data.top_processes.write_mb_per_s_avg

float · megabytes_per_second

The average write rate over the measured part of the window, counting all process writes, not only disk writes.

Network (TCP) (4)

sparklogs.data.top_processes.tcp_rx_bytes_5m

integer · bytes

TCP payload this row's processes received over the 5-minute window, from the connections the agent measures (not all of the machine's TCP traffic). Already counted in the I/O read fields. When TCP was measured, every process and remainder row carries the four TCP fields, 0 when none of the traffic was its own. All four are absent when TCP traffic was not measured for the window, and on system rows.

sparklogs.data.top_processes.tcp_tx_bytes_5m

integer · bytes

TCP payload this row's processes sent over the 5-minute window, including resent data. Absent when TCP traffic was not measured.

sparklogs.data.top_processes.tcp_rx_bytes_per_s_avg

float · bytes_per_second

The average rate this row's processes received TCP payload over the time TCP was measured in the window. Absent when TCP traffic was not measured.

sparklogs.data.top_processes.tcp_tx_bytes_per_s_avg

float · bytes_per_second

The average rate this row's processes sent TCP payload, including resent data, over the time TCP was measured in the window. Absent when TCP traffic was not measured.

Example

Inventory (every 5 minutes)

cpu 3.2% busy; top ram "sqlservr.exe" 6.0 GB; top cpu "sqlservr.exe" 2.2%; top io "services.exe" 0.0 MB/s.

sparklogs.data.top_processes.pid: 4180
sparklogs.data.top_processes.create_time_ts: 2026-07-13T09:55:00Z

SparkLogs: CONTEXT, Info, top_processes: INVENTORY: cpu 3.2% busy; top ram "sqlservr.exe" 6.0 GB; top cpu "sqlservr.exe" 2.2%; top io "services.exe" 0.0 MB/s.

Inventory (every 5 minutes)

cpu 3.2% busy; top ram "sqlservr.exe" 6.0 GB; top cpu "sqlservr.exe" 2.2%; top io "services.exe" 0.0 MB/s.

sparklogs.data.top_processes.pid: 4180
sparklogs.data.top_processes.create_time_ts: 2026-07-13T09:55:00Z

SparkLogs: CONTEXT, Info, top_processes: INVENTORY: cpu 3.2% busy; top ram "sqlservr.exe" 6.0 GB; top cpu "sqlservr.exe" 2.2%; top io "services.exe" 0.0 MB/s.