3

Does a SNMP call to get CPU usage for a Linux box eventually just read the /proc/stat file?

nivek
  • 33
  • 1
  • 3
  • 4
    Why do you ask? – ewwhite Jan 11 '16 at 18:05
  • A system admin has objected to software reading the /proc/stat file directly. I am trying to ascertain how CPU usage is being determined by other programs and mechanisms. I could not determine where SNMP was getting its info - from /proc/stat, from the device directly, etc. – nivek Jan 11 '16 at 18:30
  • 7
    > A system admin has objected to software reading the /proc/stat file directly. Please please go on, I'd absolutely love to know the mental gymnastics required for this 'objection'. – Matthew Ife Jan 11 '16 at 18:39
  • A previous monitoring program had used this method and (correctly or not) was blamed for either causing problems or making an active problem worse because of how it operated (reading the /proc/stat file, etc.). – nivek Jan 11 '16 at 18:47
  • 1
    Sounds like very thin reasoning. Of course proc is consulted as it is the sole source of truth for the info, regardless of what tool you use to parse and present the data. – dmourati Jan 11 '16 at 18:51
  • 7
    I pity the idiots you must deal with on a daily basis. – Matthew Ife Jan 11 '16 at 19:19
  • The litmus test would of course be to run net-snmp on a test system where you unmount /proc/. `/proc/` is optional as far as I know. – HBruijn Jan 11 '16 at 19:36

2 Answers2

9

Sigh1. Fortunately you don't need /proc/stat

man 5 proc:

/proc/loadavg

The first three fields in this file are load average figures giving the number of jobs in the run queue (state R) or waiting for disk I/O (state D) averaged over 1, 5, and 15 minutes. They are the same as the load average numbers given by uptime(1) and other programs. The fourth field consists of two numbers separated by a slash (/). The first of these is the number of currently runnable kernel scheduling entities (processes, threads). The value after the slash is the number of kernel scheduling entities that currently exist on the system. The fifth field is the PID of the process that was most recently created on the system.

But you probably need to consult the source for http://www.net-snmp.org/ to determine what they actually use:

net-snmp-5.7.3/agent/mibgroup/ucd-snmp/loadave.c :

#elif defined(linux)
{
    FILE           *in = fopen("/proc/loadavg", "r");
    if (!in) {
        NETSNMP_LOGONCE((LOG_ERR, "snmpd: cannot open /proc/loadavg\n"));
        return (-1);
    }

Footnote 1. Sometimes you really can't chose who you work with.

In response to your comments, again, sigh. Since only the kernel is aware of what it is actually doing, any monitoring will, one way or the other, need to interact with the kernel to retrieve such information. The common interface to interact with the kernel is /proc/ although other methods can be contrived as well (auditd and kerneltap come to mind). But those are hardly "more lightweight" at all....

There will always be a certain amount of observer effect and impact caused by monitoring.

The only zero impact method is not to do any monitoring at all. And then whoever has pager duty can claim that since no alerts were observed the system isn't down either.
I would call that a win!

HBruijn
  • 77,029
  • 24
  • 135
  • 201
  • Although a number of other metrics do rely on `/proc/stat` .... – HBruijn Jan 11 '16 at 19:05
  • 1
    And, the objection is reading from /proc generally. /proc/stat is being used as the representative example. – nivek Jan 11 '16 at 19:09
  • *Sigh* the only way to win is not to play. See my update – HBruijn Jan 11 '16 at 19:29
  • 1
    @nivek . BE MORE SPECIFIC on your question. We have no crystal ball by that asking "Does a SNMP call to get CPU usage for a Linux box eventually just read the /proc/stat file?" you mean "Hi. Does the net-snmp package reads /proc on Linux?" –  Jan 11 '16 at 19:31
  • Perhaps you should ask your 'system expert' what systems resource measuring interface he would suggest to use that *didnt* use `/proc`. – Matthew Ife Jan 11 '16 at 19:52
  • 1
    @nwildner I was as specific as I could be with the knowledge I have about SNMP. I am sorry it was not as specific as you would like. – nivek Jan 11 '16 at 20:01
  • @nivek. No need to be sorry. Just be more specific when you are using and EXAMPLE and when you want to ask about an aspect. You don´t need to be an expert on snmp neither know what software is being used. It is just ask "Does the snmp software on Linux uses `/proc` infrastructure?" –  Jan 11 '16 at 20:03
2

HBrujin has the answer to your direct question, but the actual problem being solved here warrants some additional discussion.

As you've probably gathered from the comments so far, most people are perplexed at the attitude of your coworker. This is because polling /proc for system information is fairly ubiquitous. Shy of a direct library call to poll the kernel (using a compiled language), the only way to get kernel state is to poll it from /proc or /sys.

The majority of system automation is accomplished through scripting in higher level languages. Some of these will provide library wrappers that bypass the need to read information from /proc, but shell scripting simply does not and cannot. This directly contradicts the stance of your coworker highlighted in the comment above, "the objection is reading from /proc generally".

Your coworker is misinformed and needs to let this hangup go. If others are forced to operate by these standards, they cannot do their jobs. An entire internet's worth of practical experience is working against them here. The only people who will buy this nonsense are managers who don't know better.

Andrew B
  • 32,588
  • 12
  • 93
  • 131
  • 1
    I would point out many of the C library calls you use to fetch this data are actually just wrappers and parsers for the said `/proc` files. – Matthew Ife Jan 13 '16 at 20:32