Parental control via Prometheus

[Alexander Golikov]

Hello!

I want to control time which my children play games.

I set up Windows exporter with process metrics exported to Prometheus.

I want to get alert when some process (I know label with process name) was running more than 2 hours during current day.

I have some metrics from process, the most useful is:

    windows_process_start_time{creating_process_id="12948",process="game_process_name",process_id="10884"} 1.609964221518098e+09

The simpliest alert may be

time() - windows_process_start_time{process="game_process_name"} > 7200

But the child may stop playing after 1 hour and restart the game, to it will be new windows_process_start_time metric with unique process_id.

Also child may poweroff computer and continue to play after some time.

So I want to get time while metric windows_process_start_time{process="game_process_name"} is present during current day.

Is it possible?

[Marcelo Magallón]

On Wed, Jan 6, 2021 at 2:33 PM Alexander Golikov <n270...@gmail.com> wrote:

So I want to get time while metric windows_process_start_time{process="game_process_name"} is present during current day.

Is it possible?

Since the value of the metric is the start time for that process, something like:

timestamp(windows_process_start_time{...}) - windows_process_start_time{...}

will give you the uptime for that process (assuming the metric goes stale fast enough after the process stops).

If you have multiple processes, because they have started and stopped, you'll get multiple values, so:

sum by (process) (timestamp(windows_process_start_time{...}) - windows_process_start_time{...})

gives you the accumulated run time for all the processes with the same name.

Just keep in mind that if the process doesn't stop, say for example the computer suspends, this expression will report a higher uptime and your kids will rightfully object :-)

--

Marcelo Magallón

[Alexander Golikov]

Dear Marcelo, thank you for the answer.

But the query is not so good still. If processes have multiple threads with different pids, sum grows much faster than time.

I tried to imagine something like

sum by (process) (timestamp(windows_process_start_time{}) - windows_process_start_time{process="chrome"})/3600 / count(windows_process_start_time{}) by (process)

but this does not work if the process is fully closed and restarted after sometime.

I also tried to imagine something like sum_over_time(windows_process_start_time{}[24h]^0), but this does not work due to the hard mix of range and instant vectors.

Also I tried to add %24 to try to drop values from multi-days processes.

sum by (process) (timestamp(windows_process_start_time{}) - windows_process_start_time{})/3600/24%24

Not no good, but this problem may be dropped by label filtering. Game process is usually stopped even if the computer suspends.

пн, 11 янв. 2021 г. в 16:13, 'Marcelo Magallón' via Prometheus Users <promethe...@googlegroups.com>:

--
You received this message because you are subscribed to a topic in the Google Groups "Prometheus Users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/prometheus-users/zTToHabForU/unsubscribe.
To unsubscribe from this group and all its topics, send an email to prometheus-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/prometheus-users/CABiJYgZxqtodRQox9Nh5OfnoGQCmhtxCGPrPLVQO5L9iRfo-Tg%40mail.gmail.com.

--

Regards,
Alexander Golikov