Connecting directly to endpoints

Use Direct Connect to connect directly to an endpoint to troubleshoot an issue with live and historical data. You can use this data to:

  • Understand performance events that occured on that endpoint.
  • Visualize process-level resource consumption data from the time of an incident.
  • See what processes are currently running and the resources they are consuming.
  • Access important attributes about the endpoint (such as model, CPU speed, memory capacity, and disk space).

Create a direct connection

Connect directly to an endpoint from the Direct Connect page. The Direct Connect page displays detailed process and event information from the endpoint.

  1. From the Performance menu, click Direct Connect.
  2. Enter the Computer Name (as it displays in the Computer Name sensor) or IP address for the endpoint in the Create a Direct Connection field.
  3. Click Connect.

You can also connect to an endpoint from Performance by clicking Direct Connect to Endpoint in the Action column of a chart. For more information, see Connect directly to an endpoint.

The status of the connection displays at the top of the page. To end the current connection, click Disconnect. If the connection ended due to a time-out, click Reconnect if you want to connect to the endpoint again.

View the Live Process Monitor

Expand the Live Process Monitor section to view details about the processes currently running on the endpoint: PID, Process, CPU, WSS, and Commit.

The CPU column shows the average CPU utilization for the process across all cores on the endpoint. This value is normalized to display a percentage of 0-100. On Windows endpoints, this normalized value usually matches what Task Manager reports. Click Customize Columns and add the CPU (not normalized) column to see the CPU utilization calculated as the 0-100 value multiplied by the number of cores on the endpoint. This value provides insight into whether one core on the endpoint might be over utilized by a process.

View endpoint information

Click to view the details about the endpoint.

A ribbon opens that displays the Operating System, Model, Logical Processors, CPU Speed, Total Memory, Disk Total Space, and Logged In Users for the endpoint.

Set the time frame for the data

Click to select a time frame for the displayed data: Past hour, Past 4 hours, Past 8 hours, Past day, Past 2 days, Past week, Custom.

Select Custom to define a custom date and time (in UTC) frame. After you set the custom date and time frame, click Apply Scope.

View the charts

Charts display that show performance information for the endpoint for the selected time frame. You can expand and collapse the section for each chart.

Events

The Events section displays a grid with events that occurred on the endpoint during the selected time frame and the associated Rule Type, Start Time, Duration, and Details.

In the Actions column, click Scope charts to time frame to scope the charts on the page to the time frame in which the event occurred. If the event was associated with specific processes, you can click Select top processes for this event in charts to select only those processes in the subsequent process-related charts.

CPU

The CPU section displays two charts:

  • Metrics: Displays several CPU-related metrics to show more detail about the CPU use: CPU (%), User (%), Kernel (%), and Interrupt (%). Windows endpoints also display DPC (%). For Linux and macOS endpoints, you can select Load [1m], Load [5m], and Load [15m] to add those metrics to the chart.
  • Processes: Displays the processes that were running on the endpoint during the selected time frame. Select the specific processes that you want to see in the chart.

    If the selected time frame is one day or less, you can click Select top processes to select only the top processes for the selected time frame.

    The top processes are the processes that consumed the highest amount of CPU for the duration of the selected time frame.




Memory

The Memory section displays two charts:

  • Metrics: Displays two memory-related metrics to show more detail about the memory use: Available and Used. For Windows endpoints, you can select Non-Paged Pool, Paged Pool, Pagefile Size, and Pagefile Used to add those metrics to the chart.
  • Processes: Displays the processes that were running on the endpoint during the selected time frame. Select the specific processes that you want to see in the chart.

    If the selected time frame is one day or less, you can click Select top processes to select only the top processes for the selected time frame.

    The top processes are the processes that consumed the highest amount of memory for the duration of the selected time frame.





Network

Select an adapter from the drop-down menu. You can select the following metrics to display information about that adapter: Receive Throughput (bps), Send Throughput (bps), Receive Packets (pps), Send Packets (pps), Receive Discards (pps), Receive Errors (pps), Send Discards (pps), and Send Errors (pps).

Disk

The most active disk drive is selected by default. You can select a different disk drive from the drop-down menu. You can select the following metrics to display information about that disk: Active (%), Read (%), Write (%), Read (Bps), Write (Bps), Read Latency (ms), Write Latency (ms), Reads (ops), and Writes (ops).

IO

Displays the IO usage by the processes that were running on the endpoint during the selected time frame. Select the specific processes that you want to see in the chart. If the selected time frame is one day or less, you can click Select top processes to select only the top processes for the selected time frame. The top processes are the processes that had the highest IO usage for the duration of the selected time frame.

Working with charts

Click to zoom in the charts. The charts and associated time frame adjust to a shorter range. For example, if the time range is set to Past Hour and the current charts display 15 minute increments from 3:00 PM - 4:00 PM, they shift to display 5 minute increments from 3:15 PM - 3:45 PM.

Click to zoom out the charts. The charts and associated time frame adjust to a longer range. For example, if the time range is set to Past Hour and the current charts display 15 minute increments from 3:00 PM - 4:00 PM, they shift to display 30 minute increments from 3:15 PM - 3:45 PM.

Click to pan left in the charts. The charts and associated time frame shift to earlier times in the predefined increments. For example, if the time range is set to Past Hour and the current charts display 15 minute increments from 3:00 PM - 4:00 PM, they shift to display 15 minute increments from 2:30 PM - 3:30 PM.

Click to pan right in the charts. The charts and associated time frame shift to later times in the predefined increments. For example, if the time range is set to Past Hour and the current charts display 15 minute increments from 3:00 PM - 4:00 PM, they shift to display 15 minute increments from 3:30 PM - 4:30 PM.