Overview

Find below the list of errors and warnings on devices and executions that you can use in your investigations. To the right of each error or warning condition, find the platforms to which the condition applies.

Platforms

Device warnings

Device errors

Execution warnings

Execution errors

The Device view of the Finder also highlights this kind of events for a particular device in the Errors and Warnings timelines.

Find the definition of each one of these events in the articles that describe their corresponding tooltips. The Finder displays these tooltips when you hover your mouse over a particular occurrence of the event in the timelines of the Device View or the User View.

Note however that the High CPU usage warning has been renamed to High thread CPU usage, when applied to executions, and to High thread CPU usage (deprecated), when applied to devices. Indeed, on devices, the warning has been deprecated in favor of the new High overall CPU usage warning. See the explanation in the section below.

Reported application crashes and not responding events

Application crashes

Applications can provide their own crash handlers, effectively masking their failures from Nexthink.

In the case of the Mac platform, Nexthink reports the crashes of all applications that use the standard logs in macOS to record their crash events. If an application reports a crash by the standard means, macOS shows up a warning. All applications crashes that trigger the warning are reported correctly by Nexthink. For instance, if Chrome crashes, the macOS user sees the following warning:

Application not responding events

In macOS, users must close a non-responding application for the Collector to issue an application not responding event; whereas in Windows, the Collector can report an application not responding event even if the user does not close the offending application.

Device warnings on CPU usage

There are two warnings generated by the Engine to indicate a high CPU condition on a device:

High overall CPU usage | Windows | macOS

The first warning, High thread CPU usage (deprecated), is triggered when the CPU load is above 80% in a single logical processor (hardware thread) of a device for more than 30 seconds. This threshold has demonstrated to be somewhat low for the high capacity of modern CPUs with multiple cores. For instance, a quad-core device with hyper-threading technology has two hardware threads per core, making a total of 8 logical processors (threads) and a capacity of 800%. Thus, a load of 80% represents only the 10% of the total capacity of the CPU, which is certainly not that significant.

The second warning, High overall CPU usage, takes into account the total capacity of the CPU in a device. It is triggered when the CPU load is above 70% over all the logical processors combined for more than 30 seconds. That is, the threshold is 70% over a normalized CPU capacity of 100%. For the same quad-core device as in the example above, that would mean a 560% load over 800% of total capacity, which is indeed a high CPU load.

Aggregates on CPU usage warnings

For the previous warning events, two aggregates let you know the percentage of time that devices are under a high CPU condition. There is also a similar aggregate for applications:

Typically, the aggregate High device thread CPU time ratio (deprecated) displays higher ratios of time spent by devices under a high CPU condition. Those ratios may be unrealistically high for devices with multiple-core CPUs for the same reasons as explained above for its associated warning. Preferably use the aggregate High device overall CPU time ratio.

The aggregate High application thread CPU time ratio lets you find applications with high CPU consumption or, when applied to binaries, compare the different versions of a same application and see which one stays longer in a high CPU condition.

RELATED TASK

RELATED CONCEPT

RELATED REFERENCES

Last updated 8 months ago

Was this helpful?

Overview

Find below the list of errors and warnings on devices and executions that you can use in your investigations. To the right of each error or warning condition, find the platforms to which the condition applies.

Platforms

Device warnings

Device errors

Execution warnings

Execution errors

The Device view of the Finder also highlights this kind of events for a particular device in the Errors and Warnings timelines.

Find the definition of each one of these events in the articles that describe their corresponding tooltips. The Finder displays these tooltips when you hover your mouse over a particular occurrence of the event in the timelines of the Device View or the User View.

Note however that the High CPU usage warning has been renamed to High thread CPU usage, when applied to executions, and to High thread CPU usage (deprecated), when applied to devices. Indeed, on devices, the warning has been deprecated in favor of the new High overall CPU usage warning. See the explanation in the section below.

Reported application crashes and not responding events

Application crashes

Applications can provide their own crash handlers, effectively masking their failures from Nexthink.

In the case of the Mac platform, Nexthink reports the crashes of all applications that use the standard logs in macOS to record their crash events. If an application reports a crash by the standard means, macOS shows up a warning. All applications crashes that trigger the warning are reported correctly by Nexthink. For instance, if Chrome crashes, the macOS user sees the following warning:

Application not responding events

The Collector reports the occurrence of differently.

In macOS, users must close a non-responding application for the Collector to issue an application not responding event; whereas in Windows, the Collector can report an application not responding event even if the user does not close the offending application.

Device warnings on CPU usage

There are two warnings generated by the Engine to indicate a high CPU condition on a device:

High overall CPU usage | Windows | macOS

The first warning, High thread CPU usage (deprecated), is triggered when the CPU load is above 80% in a single logical processor (hardware thread) of a device for more than 30 seconds. This threshold has demonstrated to be somewhat low for the high capacity of modern CPUs with multiple cores. For instance, a quad-core device with hyper-threading technology has two hardware threads per core, making a total of 8 logical processors (threads) and a capacity of 800%. Thus, a load of 80% represents only the 10% of the total capacity of the CPU, which is certainly not that significant.

The second warning, High overall CPU usage, takes into account the total capacity of the CPU in a device. It is triggered when the CPU load is above 70% over all the logical processors combined for more than 30 seconds. That is, the threshold is 70% over a normalized CPU capacity of 100%. For the same quad-core device as in the example above, that would mean a 560% load over 800% of total capacity, which is indeed a high CPU load.

Aggregates on CPU usage warnings

For the previous warning events, two aggregates let you know the percentage of time that devices are under a high CPU condition. There is also a similar aggregate for applications:

Name

Applies to

Description

Typically, the aggregate High device thread CPU time ratio (deprecated) displays higher ratios of time spent by devices under a high CPU condition. Those ratios may be unrealistically high for devices with multiple-core CPUs for the same reasons as explained above for its associated warning. Preferably use the aggregate High device overall CPU time ratio.

The aggregate High application thread CPU time ratio lets you find applications with high CPU consumption or, when applied to binaries, compare the different versions of a same application and see which one stays longer in a high CPU condition.

RELATED TASK

RELATED CONCEPT

RELATED REFERENCES