Stay organized with collections
Save and categorize content based on your preferences.
This document describes how to use the Google Cloud console to create an alerting
policy that monitors the number of processes running on your
virtual machines (VMs) that meet conditions you specify. This type of
alerting policy is sometimes called a process-health alerting policy.
For example, you can count the number of processes started by the root user.
You can also count the number of processes whose invocation command contained
a specific string. An alerting policy can notify you when
the number of processes is more than, or less than, a threshold.
For information about which processes can be monitored,
see Processes that are monitored.
This content does not apply to log-based alerting policies.
For information about log-based alerting policies, which notify you when a
particular message appears in your logs, see
Monitoring your logs.
Before you begin
To get the permissions that
you need to create and modify alerting policies by using the Google Cloud console,
ask your administrator to grant you the
Monitoring Editor (roles/monitoring.editor)
IAM role on your project.
For more information about granting roles, see Manage access to projects, folders, and organizations.
Ensure that you're familiar with the general concepts of alerting policies.
For information about these topics, see
Alerting overview.
Configure the notification channels that you want to use to receive any
alerts. For redundancy purposes, we also recommend that you create
multiple types of notification channels. For information about these steps,
see Create and manage notification channels.
Ensure that you've installed the Ops Agent on the VMs that you want
to monitor. For more information, see
Google Cloud Observability agents.
Create alerting policy
To create an alerting policy that monitors the count of processes running on
a VM by using the Cloud Monitoring API, the filter expression must specify
a time series selector. For an example of a JSON file that specifies this
selector, see Process-health policy.
To create an alerting policy that monitors the count of processes running on
a VM, do the following:
In the Google Cloud console, go to the
notificationsAlerting page:
Not all processes running in your system can be monitored by a process-health
condition. This condition selects processes to be monitored by using a regular
expression that is applied to the command line that invoked the process. When
the command line field isn't available, the process can't be monitored.
One way to determine if a process can be monitored by a process-health condition
is to look at the active processes. For example, on a Linux system, you
can use the ps command:
ps aux | grep nfs
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1598 0.0 0.0 0 0 ? S< Oct25 0:00 [nfsd4]
root 1639 0.0 0.0 0 0 ? S Oct25 2:33 [nfsd]
root 1640 0.0 0.0 0 0 ? S Oct25 2:36 [nfsd]
When a COMMAND entry is wrapped with square brackets, for example [nfsd],
the command-line information for the process isn't available. In this situation,
you can't use Cloud Monitoring to monitor the process.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["# Monitor count of processess on a VM\n\nThis document describes how to use the Google Cloud console to create an alerting\npolicy that monitors the number of processes running on your\nvirtual machines (VMs) that meet conditions you specify. This type of\nalerting policy is sometimes called a *process-health* alerting policy.\nFor example, you can count the number of processes started by the root user.\nYou can also count the number of processes whose invocation command contained\na specific string. An alerting policy can notify you when\nthe number of processes is more than, or less than, a threshold.\nFor information about which processes can be monitored,\nsee [Processes that are monitored](#process-health-processes).\n\n\nThis content does not apply to log-based alerting policies.\nFor information about log-based alerting policies, which notify you when a\nparticular message appears in your logs, see\n[Monitoring your logs](/logging/docs/alerting/monitoring-logs).\n\nBefore you begin\n----------------\n\n1.\n\n To get the permissions that\n you need to create and modify alerting policies by using the Google Cloud console,\n\n ask your administrator to grant you the\n\n\n [Monitoring Editor](/iam/docs/roles-permissions/monitoring#monitoring.editor) (`roles/monitoring.editor`)\n IAM role on your project.\n\n\n For more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\n You might also be able to get\n the required permissions through [custom\n roles](/iam/docs/creating-custom-roles) or other [predefined\n roles](/iam/docs/roles-overview#predefined).\n\n For more information about Cloud Monitoring roles,\n see [Control access with Identity and Access Management](/monitoring/access-control).\n2. Ensure that you're familiar with the general concepts of alerting policies.\n For information about these topics, see\n [Alerting overview](/monitoring/alerts).\n\n3. Configure the notification channels that you want to use to receive any\n alerts. For redundancy purposes, we also recommend that you create\n multiple types of notification channels. For information about these steps,\n see [Create and manage notification channels](/monitoring/support/notification-options).\n\n4. Ensure that you've installed the Ops Agent on the VMs that you want\n to monitor. For more information, see\n [Google Cloud Observability agents](/monitoring/agent).\n\nCreate alerting policy\n----------------------\n\nTo create an alerting policy that monitors the count of processes running on\na VM by using the Cloud Monitoring API, the filter expression must specify\na time series selector. For an example of a JSON file that specifies this\nselector, see [Process-health policy](/monitoring/alerts/policies-in-json#json-process-health).\n\nTo create an alerting policy that monitors the count of processes running on\na VM, do the following:\n\n1. In the Google Cloud console, go to the\n *notifications* **Alerting** page:\n\n [Go to **Alerting**](https://console.cloud.google.com/monitoring/alerting)\n\n \u003cbr /\u003e\n\n If you use the search bar to find this page, then select the result whose subheading is\n **Monitoring**.\n2. Select **Create policy**.\n3. Select **?** on the **Select metric** section header and then select\n **Direct filter mode** in the tooltip.\n\n4. Enter a Monitoring filter.\n\n For example, to count the number of processes that are running on\n Compute Engine VM instances whose name includes `nginx`, enter the\n following: \n\n select_process_count(\"monitoring.regex.full_match(\\\".*nginx.*\\\")\")\n resource.type=\"gce_instance\"\n\n For syntax information see the following resources:\n - For filters used to count processes running on virtual machines, see [Process-health filters](/monitoring/api/v3/process-health-filters).\n - For general syntax, see [Monitoring filters](/monitoring/api/v3/filters).\n5. Complete the alerting policy. You must configure the condition trigger,\n notifications, documentation, and policy name,\n and then click **Create policy**.\n\n For more information, see\n [Create metric-threshold alerting policies](/monitoring/alerts/using-alerting-ui).\n\nProcesses that are monitored\n----------------------------\n\nNot all processes running in your system can be monitored by a process-health\ncondition. This condition selects processes to be monitored by using a regular\nexpression that is applied to the command line that invoked the process. When\nthe command line field isn't available, the process can't be monitored.\n\nOne way to determine if a process can be monitored by a process-health condition\nis to look at the active processes. For example, on a Linux system, you\ncan use the `ps` command: \n\n ps aux | grep nfs\n USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND\n root 1598 0.0 0.0 0 0 ? S\u003c Oct25 0:00 [nfsd4]\n root 1639 0.0 0.0 0 0 ? S Oct25 2:33 [nfsd]\n root 1640 0.0 0.0 0 0 ? S Oct25 2:36 [nfsd]\n\nWhen a `COMMAND` entry is wrapped with square brackets, for example `[nfsd]`,\nthe command-line information for the process isn't available. In this situation,\nyou can't use Cloud Monitoring to monitor the process."]]