/dt-obs-hosts

name: dt-obs-hosts
description: >-
  Host and process metrics including CPU, memory, disk, network, containers, and process-level
  telemetry. Use when analyzing infrastructure health, resource utilization, process consumption,
  or host discovery. Also use when building timeseries queries for host metrics that feed into
  analytical workflows like anomaly detection, forecasting, or seasonality analysis.
  Trigger: "show hosts", "CPU usage", "memory utilization", "disk space", "high CPU",
  "top hosts by CPU", "top processes by memory",
  "Linux hosts in AWS", "what databases are running", "infrastructure costs by cost center",
  "hosts running EOL Java", "container monitoring", "listening ports",
  "process resource consumption", "CPU forecast", "memory anomaly", "host seasonality",
  "OneAgent mode", "OneAgent version", "GCP hosts".
  Do NOT use for explaining existing queries, product documentation questions,
  Kubernetes pod/workload queries (use dt-obs-kubernetes), AWS cloud resource inventory
  (use dt-obs-aws), or service-level metrics (use dt-obs-services).
license: Apache-2.0

Infrastructure Hosts Skill

Monitor and manage host and process infrastructure including CPU, memory, disk, network, and technology inventory.

When to Use This Skill

Use this skill when the user needs to:

• **Inventory:** "Show me all Linux hosts in AWS us-east-1"
• **Agent Inventory:** "Which hosts run FULL_STACK, INFRASTRUCTURE, or DISCOVERY mode?" / "Show OneAgent version distribution"
• **Monitor:** "What hosts have high CPU usage?"
• **Troubleshoot:** "Which processes are consuming the most memory?"
• **Discover:** "What databases are running in production?"
• **Plan:** "Track Kubernetes version distribution for upgrade planning"
• **Cost:** "Calculate infrastructure costs by cost center"
• **Security:** "Find all processes listening on port 22"
• **Compliance:** "Identify hosts running EOL Java versions"
• **Quality:** "Check data completeness for AWS hosts"
• **Optimize:** "Find rightsizing candidates based on utilization"

--- > **Cross-source join required:** If the query must combine host data with logs or other > telemetry sources (e.g. "show logs from Linux hosts with their IP addresses") → also read > `dt-dql-essentials/references/smartscape-topology-navigation.md` before writing the query. ---

Core Concepts

Entities

• **HOST** - Physical or virtual machines (cloud or on-premise)
• **PROCESS** - Running processes and process groups
• **CONTAINER** - Kubernetes containers
• **NETWORK_INTERFACE** - Host network interfaces
• **DISK** - Host disk volumes

Metrics Categories

1. **Host Metrics** - `dt.host.cpu.*`, `dt.host.memory.*`, `dt.host.disk.*`, `dt.host.net.*` 2. **Process Metrics** - `dt.process.cpu.*`, `dt.process.memory.*`, `dt.process.io.*`, `dt.process.network.*` 3. **Inventory** - OS type, cloud provider, technology stack, versions 4. **Cost** - `dt.cost.costcenter`, `dt.cost.product` 5. **Quality** - Metadata completeness, version compliance

Alert Thresholds

• **CPU/Memory/Disk:** 80% warning, 90% critical
• **Network:** >70% high, >85% saturated
• **Disk Latency:** >20ms bottleneck
• **Network Errors:** Drop rate >1%, error rate >0.1%
• **Swap:** >30% warning, >50% critical

---

Key Workflows

1. Host Discovery and Classification

Discover hosts, classify by OS/cloud, inventory resources.

smartscapeNodes "HOST"
| fieldsAdd os.type, cloud.provider, host.logical.cpu.cores, host.physical.memory
| summarize host_count = count(), by: {os.type, cloud.provider}
| sort host_count desc

**OS Types:** `LINUX`, `WINDOWS`, `AIX`, `SOLARIS`, `ZOS`

→ For cloud-specific attributes, see [references/inventory-discovery.md](#cloud-specific-attributes)

2. Resource Utilization Monitoring

Monitor CPU, memory, disk, network across hosts.

timeseries {
  cpu = avg(dt.host.cpu.usage),
  memory = avg(dt.host.memory.usage),
  disk = avg(dt.host.disk.used.percent)
}, by: {dt.smartscape.host}
| fieldsAdd host_name = getNodeName(dt.smartscape.host)
| filter arrayAvg(cpu) > 80 or arrayAvg(memory) > 80
| sort arrayAvg(cpu) desc

**High utilization threshold:** 80% warning, 90% critical

**Key CPU Metrics:**

• `dt.host.cpu.usage` — Total CPU utilization (0-100%)
• `dt.host.cpu.idle` — CPU idle time (inverse of usage; useful for anomaly detection)
• `dt.host.cpu.user` — CPU time in user mode
• `dt.host.cpu.system` — CPU time in kernel mode
• `dt.host.cpu.iowait` — CPU waiting for I/O (Linux only)

→ For detailed CPU analysis, see [references/host-metrics.md](references/host-metrics.md#cpu-monitoring) → For memory breakdown, see [references/host-metrics.md](references/host-metrics.md#memory-monitoring)

Disk Free Space — Find Hosts with Most/Least Free Disk

timeseries disk_used_pct = avg(dt.host.disk.used.percent), by: {dt.smartscape.host}
| fieldsAdd host_name = getNodeName(dt.smartscape.host)
| fieldsAdd avg_disk_used = arrayAvg(disk_used_pct),
    free_pct = 100 - arrayAvg(disk_used_pct)
| sort free_pct desc
| limit 10

3. Process Resource Analysis

Identify top resource consumers at process level.

timeseries {
  cpu = avg(dt.process.cpu.usage),
  memory = avg(dt.process.memory.usage)
}, by: {dt.smartscape.process}
| fieldsAdd process_name = getNodeName(dt.smartscape.process)
| filter arrayAvg(cpu) > 50
| sort arrayAvg(cpu) desc
| limit 20

→ For process I/O analysis, see [references/process-monitoring.md](references/process-monitoring.md#process-io) → For process network metrics, see [references/process-monitoring.md](references/process-monitoring.md#process-network)

4. Technology Stack Inventory

Discover and track software technologies and versions.

smartscapeNodes "PROCESS"
| fieldsAdd process.software_technologies
| expand tech = process.software_technologies
| fieldsAdd tech_type = tech[type], tech_version = tech[version]
| summarize process_count = count(), by: {tech_type, tech_version}
|