Cloud Monitor:Infrastructure monitoring and operating system monitoring

Collection and reporting

The CloudMonitor host probe samples data once per second and aggregates it into a data point every 15 seconds. Each data point includes three values: min, max, and avg.

Metrics

OS monitoring metrics are collected every 15 seconds and categorized as follows:

• CPU-related metrics

  • Windows

    The `NtQuerySystemInformation` function in `ntdll` is called to obtain the time spent by each part of the CPU. By calling this function twice at an interval, you can calculate the percentage of time spent by each part of the CPU during that interval.

  • Linux

    The metrics in the following table correspond to the top command output.

  Metric Name	Description	Unit	MetricName	Dimensions	Statistics	Description (Linux only)
  (Agent) cpu.idle	Percentage of idle CPU.	%	cpu_idle	userId, instanceId	Maximum, Minimum, Average	The percentage of time that the CPU is idle.
  (Agent) cpu.system	Percentage of CPU time spent in kernel space.	%	cpu_system	userId, instanceId	Maximum, Minimum, Average	Overhead from system context switches. High values indicate excessive processes or threads.
  (Agent) cpu.user	Percentage of CPU time spent in user space.	%	cpu_user	userId, instanceId	Maximum, Minimum, Average	CPU consumption by user processes.
  (Agent) cpu.wait	Percentage of CPU time spent waiting for I/O operations.	%	cpu_wait	userId, instanceId	Maximum, Minimum, Average	High values indicate frequent I/O operations.
  (Agent) cpu.other	Percentage of CPU time spent on other tasks.	%	cpu_other	userId, instanceId	Maximum, Minimum, Average	Other consumption = Nice + SoftIrq + Irq + Stolen.
  (Agent) cpu.total	Total percentage of CPU consumed.	%	cpu_total	userId, instanceId	Maximum, Minimum, Average	CPU usage = 1 - Host.cpu.idle

  Note

  CloudMonitor's CPU usage metric includes iowait (wa) time. When an application is blocked waiting for I/O operations, top or htop may show no specific high-CPU process, but CloudMonitor's total CPU usage reads higher because of the elevated wa value. Additionally, CloudMonitor displays aggregate values (maximum or average) collected over the monitoring interval, whereas top shows a real-time snapshot by default. To capture transient CPU spikes that match CloudMonitor readings, run top -d 0.5 to increase the refresh rate.

• Memory-related metrics

  • Windows

    The `GlobalMemoryStatusEx` function in `kernel32.dll` is called to obtain the current usage of physical and virtual memory for a 32-bit Windows operating system.

  • Linux

    The metrics in the following table correspond to the free command output. The data source is /proc/meminfo.

  Metric	Description	Unit	MetricName	Dimensions	Statistics	Description (Linux only)
  (Agent) memory.total.space	Total memory.	Byte	memory_totalspace	userId, instanceId	Maximum, Minimum, Average	The total amount of memory on the server. This corresponds to MemTotal in /proc/meminfo.
  (Agent) memory.free.space	Amount of free memory.	Byte	memory_freespace	userId, instanceId	Maximum, Minimum, Average	The amount of available memory in the system. This corresponds to MemFree in /proc/meminfo.
  (Agent) memory.used.space	Amount of used memory.	Byte	memory_usedspace	userId, instanceId	Maximum, Minimum, Average	The amount of used memory in the system. Calculation method: total - free.
  (Agent) memory.actualused.space	The amount of memory consumed by the user.	Byte	memory_actualusedspace	userId, instanceId	Maximum, Minimum, Average	Calculation method: If MemAvailable is present in /proc/meminfo: total - MemAvailable If MemAvailable is not present in /proc/meminfo: used - buffers - cached Note On systems such as CentOS 7.2 and Ubuntu 16.04 or later that use a new Linux kernel, memory estimation is more accurate. For the specific meaning of MemAvailable, see this commit.
  (Agent) memory.free.utilization	Percentage of free memory.	%	memory_freeutilization	userId, instanceId	Maximum, Minimum, Average	Calculation method: If MemAvailable is present in /proc/meminfo: (MemAvailable / total) × 100%. If MemAvailable is not present in /proc/meminfo: ((total - actualused) / total) × 100%.
  (Agent) memory.used.utilization	Memory usage.	%	memory_usedutilization	userId, instanceId	Maximum, Minimum, Average	Calculation method: If MemAvailable is present in /proc/meminfo: ((total - MemAvailable) / total) × 100%. If MemAvailable is not present in /proc/meminfo: ((total - free - buffers - cached) / total) × 100%.

  Note

  The memory usage rate metric (memory.used.utilization) in CloudMonitor excludes Buffers/Cache. It is calculated using the formula: (Total − MemAvailable) / Total × 100% (when MemAvailable is available in /proc/meminfo). This more accurately reflects the truly available memory compared to the legacy free command output, where the "Used" value includes system cache. If you observe a discrepancy between CloudMonitor memory usage and the output of the free command, this is expected behavior.

  Note

  CloudMonitor does not currently include a SWAP (swap partition) usage metric. If SWAP monitoring is required, consider the following alternatives:

  • Monitor physical memory usage (memory.used.utilization): SWAP is typically used heavily only when physical memory is insufficient. Monitoring physical memory usage is usually sufficient to detect memory pressure.

  • Custom SWAP monitoring through Simple Log Service (SLS): Use the host log local collection feature of Simple Log Service (SLS) to collect and aggregate SWAP usage information from the instance.

• System average load metrics

  • Windows

    The monitoring metric does not exist.

  • Linux

    The metrics in the following table correspond to the top command output. Higher values indicate a busier system.

  Metric Name	Description	Unit	MetricName	Dimensions	Statistics
  (Agent) load.1m	Average system load over the past 1 minute.	None	load_1m	userId, instanceId	Maximum, Minimum, Average
  (Agent) load.5m	Average system load over the past 5 minutes.	None	load_5m	userId, instanceId	Maximum, Minimum, Average
  (Agent) load.15m	Average system load over the past 15 minutes.	None	load_15m	userId, instanceId	Maximum, Minimum, Average
  (Agent) load.1m.percore	Average system load per CPU core over the past 1 minute.	None	load_per_core_1m	userId, instanceId	Maximum, Minimum, Average
  (Agent) load.5m.percore	Average system load per CPU core over the past 5 minutes.	None	load_per_core_5m	userId, instanceId	Maximum, Minimum, Average
  (Agent) load.15m.percore	Average system load per CPU core over the past 15 minutes.	None	load_per_core_15m	userId, instanceId	Maximum, Minimum, Average

• Disk-related metrics

  • Windows

    First, the `GetDiskFreeSpaceExA` function in `Kernel32.dll` is called to retrieve the available disk space. This provides the used storage space, disk usage, free storage space, and total storage space of the disk. Then, the `RegConnectRegistryA` function is called to connect to the `HKEY_PERFORMANCE_DATA` registry. Finally, the `RegQueryValueExA` function is called to query disk-related properties from the `HKEY_PERFORMANCE_DATA` registry. These properties include read count, write count, bytes written, bytes read, time spent reading, time spent writing, and disk usage time.

  • Linux

    Disk usage and inode metrics correspond to the df command output. Disk read/write metrics correspond to the iostat command output.

  Metric	Description	Unit	MetricName	Dimensions	Statistics
  Host.diskusage.used	Used disk storage space.	Byte	diskusage_used	userId, instanceId, device	Maximum, Minimum, Average
  Host.diskusage.utilization	Disk usage for regular users.	%	diskusage_utilization	userId, instanceId, device	Maximum, Minimum, Average
  Host.diskusage.free	Free disk storage space for regular users and superusers.	Byte	diskusage_free	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) disk.usage.avail_device	Free disk storage space for regular users.	Byte	diskusage_avail	userId, instanceId, device	Maximum, Minimum, Average
  Host.diskusage.total	Total disk storage space.	Byte	diskusage_total	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) disk.read.bps_device	Bytes read from the disk per second.	Byte/s	disk_readbytes	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) disk.write.bps_device	Bytes written to the disk per second.	Byte/s	disk_writebytes	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) disk.read.iops_device	Number of read requests to the disk per second.	counts/s	disk_readiops	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) disk.write.iops_device	Number of write requests to the disk per second.	counts/s	disk_writeiops	userId, instanceId, device	Maximum, Minimum, Average

• File system metrics

  • Windows

    The specified monitoring metric does not exist.

  • Linux

    The metrics in the following table correspond to the df command output.

  Monitoring Metric Name	Description	Unit	MetricName	Dimensions	Statistics	Description (Linux only)
  (Agent) fs.inode.utilization_device	inode usage.	%	fs_inodeutilization	userId, instanceId, device	Maximum, Minimum, Average	Linux tracks files by inode numbers. When all inodes are allocated, no new files can be created even if disk space remains. Many small files can exhaust inodes.

  Note

  The "Available disk space" metric (diskusage_free) in host monitoring includes the file system's reserved block space (Reserved block count). As a result, the value may differ from the available space shown by commands such as df inside the OS. This is expected behavior. To inspect the size of the reserved space on a specific device, run the following command:

  tune2fs -l <device>

• Network-related metrics

  • Windows

    First, the `GetAdaptersAddresses` function in `iphlpapi.dll` is called to retrieve the adapter addresses on the local machine. Then, the `GetIfTable` function is called to retrieve network metrics for each interface. These metrics include bits received per second, bits sent per second, packets received per second, packets sent per second, received error packets, and sent error packets.

  • Linux

    • TCP connection counts correspond to the ss command output.

      Note

      TCP connection count includes all TCP connections on the ECS host.

      By default, the following TCP connection states are collected: TCP_TOTAL (total connections), ESTABLISHED (connections in the established state), and NON_ESTABLISHED (connections in non-established states, which includes all states other than ESTABLISHED).

    • Network traffic metrics in the following table correspond to the iftop command output.

  Metric Name	Description	Unit	MetricName	Dimensions	Statistics
  (Agent) network.in.rate_device	Inbound NIC bandwidth (bits received per second).	bit/s	networkin_rate	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) network.out.rate_device	Outbound NIC bandwidth (bits sent per second).	bit/s	networkout_rate	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) network.in.packages_device	Packets received by the NIC per second.	packets/s	networkin_packages	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) network.out.packages_device	Packets sent by the NIC per second.	packets/s	networkout_packages	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) network.in.errorpackages_device	Number of received error packets detected by the device drive.	packets/s	networkin_errorpackages	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) network.out.errorpackages_device	Number of sent error packets detected by the device drive.	packets/s	networkout_errorpackages	userId, instanceId, device	Maximum, Minimum, Average
  (Agent) network.tcp.connection_state	Number of TCP connections in various states, including the following: LISTEN, SYN_SENT, ESTABLISHED, SYN_RECV, FIN_WAIT1, CLOSE_WAIT, FIN_WAIT2, LAST_ACK, TIME_WAIT, CLOSING, and CLOSED.	Count	net_tcpconnection	userId, instanceId, state	Maximum, Minimum, Average

• Top 5 process-related metrics

  • Windows

    • Query

      First, the `OpenProcess` function in `Kernel32.dll` is called to access the process. The `GetProcessTimes` function is called twice at an interval to calculate the CPU usage ratio. Then, the `RegConnectRegistryA` function is called to connect to the `HKEY_PERFORMANCE_DATA` registry. Finally, the `RegQueryValueExA` function is called to query the registry for process properties. These properties include process ID, parent process ID, priority, virtual memory, resident memory, shared memory, process name, number of open files, number of threads, page faults, bytes read, and bytes written.

    • Process count (Host.process.number)

      • The `OpenProcess` function is called to open the target process. The `NtQueryInformationProcess` function in `NTDLL` is called to retrieve `RTL_USER_PROCESS_PARAMETERS` information. The `ReadProcessMemory` function is called to retrieve the process command line. This action obtains the process arguments (args) and its root running path, which is the current working directory.

      • The `OpenProcessToken` function is called to retrieve the access token handle. The `GetTokenInformation` function is called to retrieve the token information. The `LookupAccountSid` function is called to obtain the process username and user group.

      • For each process, its arguments (args), root running path, username, and user group are matched against a keyword. If a match is found, a counter is incremented by 1.

  • Linux

    • Process CPU and memory metrics correspond to the top command output. CPU usage reflects multi-core usage.

    • Host.process.openfile corresponds to the lsof command output.

    • Host.process.number corresponds to the ps aux | grep '<keyword>' command output.

  Metric	Description	Unit	MetricName	Dimensions	Statistics	Notes
  (Agent) process.cpu_pid	Percentage of CPU consumed by a specific process.	%	process.cpu	userId, instanceId, name, pid	Average	Alerting is not supported.
  (Agent) process.memory_pid	Percentage of memory consumed by a specific process.	%	process.memory	userId, instanceId, name, pid	Average	Alerting is not supported.
  (Agent) process.openfile_pid	Number of files opened by the current process.	Unit	process.openfile	userId, instanceId, name, pid	Average	Alerting is not supported.
  (Agent) process.count_processname	Number of processes with the specified keyword.	Unit	process.number	userId, instanceId, processName	Average	Alerting is not supported.

View operating system monitoring data

1. Log on to the Cloud Monitor console.

2. In the left-side navigation pane, choose Cloud Resource Monitoring > Host Monitoring.

3. On the Host Monitoring page, click the target instance's name, or click View Charts in its Actions column.

   On the OS Monitoring tab, view OS monitoring data. You can also Create an alert rule for a host or View alerts.