uberAgent

How to Report on CPU Seconds & RAM GB Hours per User

uberAgent determines all the required data for charging based on usage. If you want to bill your customers depending on how much CPU or RAM their users’ sessions consume you basically need the metrics CPU seconds per user and RAM GB hours per user. The latter can be explained as the number of gigabytes of RAM multiplied by the number of hours.

Example: RAM GB Hours per User

User A runs one session with an average RAM footprint of 2 GB for 3 hours. User B runs 2 sessions for 5 hours, one with an average RAM footprint of 1 GB and the other with an average RAM footprint of 2 GB. GB hours would be:

  • User A: 2 GB * 3 hours = 6 GB hours
  • User B: 1 GB * 5 hours + 2 GB * 5 hours = 15 GB hours

The following Splunk search will return the total CPU seconds and RAM GB hours per Active Directory user account. It can be run over any time range (= billing period). Please note that due to the nature of the calculation every started hour counts in full, i.e. the resolution is one hour.

| pivot uberAgent Session_SessionDetail_Users
   first(SessionUserLower) as User
   avg(SessionWorkingSetMB) as AvgHourSessionWorkingSetMB
   sum(SessionCPUTimeS) as SumHourSessionCPUTimeS
   splitrow
      _time
      period hour
   splitrow
      SessionGUID
| eval AvgHourSessionWorkingSetGB=AvgHourSessionWorkingSetMB/1024
| stats
   count as SessionHours
   sum(AvgHourSessionWorkingSetGB) as GBHours
   sum(SumHourSessionCPUTimeS) as CPUSeconds
   avg(AvgHourSessionWorkingSetGB) as AvgSessionGB
   by
      User
| eval GBHoursRounded=round(GBHours, 2)
| eval CPUSecondsRounded=round(CPUSeconds, 2)
| eval AvgSessionGBRounded=round(AvgSessionGB, 2)
| fields
   User
   SessionHours
   GBHoursRounded
   CPUSecondsRounded
   AvgSessionGBRounded
<!--NeedCopy-->

Above search returns these fields per user:

  • RAM GB hours
  • CPU seconds
  • Session hours (sessions * hours run per session)
  • Average memory usage per session

How it Works

We are searching uberAgent’s accelerated data model. That is why we use the pivot command.

The search consists of two main parts. First, we determine the average RAM usage per session and hour. Then we summarize the session hours per user.

CPU usage is even easier to calculate because uberAgent already reports it as CPU seconds so that we already have the length of time. We only need to summarize; we do that in two steps because the search needs to be constructed that way to determine RAM usage.

How to Report on CPU Seconds & RAM GB Hours per User