Processes

The Processes page gives you a live view into what’s actually running on a device — useful for tracking down a runaway process or confirming an application is up.

Selecting a device

Pick any agent from the device list on the left. Its process table loads immediately and refreshes automatically every 10 seconds; a countdown in the header shows time to the next refresh, and you can trigger an immediate refresh from the table footer.

The process table

Guardian shows the 30 processes using the most memory plus the 15 using the most CPU plus the 10 doing the most disk I/O (at most 55, with overlap listed once), so a busy process with a small memory footprint is never missing. The columns are:

• PID
• Name
• State — running, sleeping, waiting, zombie, or stopped, color-coded
• CPU % — the share of one core the process used since the previous refresh, so 100 means one core fully busy and a multi-threaded process can show more than 100. It is computed from the change in the process’s CPU time between pulses, so the first reading after an agent starts shows 0. (Older agents reported no CPU on Linux and Windows.)
• Memory — value plus a proportional bar relative to the heaviest process shown
• Disk — bytes read plus written per second since the previous refresh (hover for the read and write split). On Linux this is storage I/O from /proc/<pid>/io; on Windows it is the process’s total I/O transfer count, which includes network and device transfers as Windows counts them. A dash means it was not measured (a process the agent may not inspect, or macOS, which has no cheap per-process counter). The first reading after an agent starts shows a dash.
• Conns — established TCP connections (IPv4 and IPv6) the process holds right now. Windows and Linux only.
• User — not reported on Windows.

Click any column header to sort by it; click again to reverse the direction. Use the search box to filter by process name, PID, or user.

When there’s no data

If an agent hasn’t reported process data yet, the table shows a “waiting for next agent pulse” message. If the agent’s version doesn’t support process reporting, an error is shown instead.