Errors and warnings for devices and executions with Finder (classic)

Overview

Below is a list of errors and warnings for devices and executions that you can use in your investigations. To the right of each error or warning condition, the platforms to which the condition applies are listed.

The Device view of Finder also highlights these kinds of events for a particular device in the Errors and Warnings timelines.

Find the definition of each one of these events in the articles that describe their corresponding tooltips. Finder displays these tooltips when you hover your cursor over a particular occurrence of the event in the timelines of the Device View or the User View.

Note, however, that the High CPU usage warning has been renamed to High thread CPU usage, when applied to executions, and to High thread CPU usage (deprecated), when applied to devices. Indeed, on devices, the warning has been deprecated in favor of the new High overall CPU usage warning. For a full explanation, see the next section.

Reported application crashes and not responding events

Application crashes

Applications can provide their own crash handlers, effectively masking their failures from Nexthink.

In the case of the Mac platform, Nexthink reports the crashes of all applications that use the standard logs in macOS to record their crash events. If an application reports a crash by the standard means, a warning will appear in macOS. All application crashes that trigger the warning are reported correctly by Nexthink. For instance, if Chrome crashes, the macOS user sees the following warning:

Application not responding events

Collector reports the occurrence of non-responding applications in Windows and macOS differently.

In macOS, users must close a non-responding application for Collector to issue an application not responding event. In Windows, however, Collector can report an application not responding event even if the user does not close the offending application.

Device warnings on CPU usage

There are two warnings generated by Engine to indicate a high CPU condition on a device:

• High thread CPU usage (deprecated)

• High overall CPU usage

The first warning, High thread CPU usage (deprecated), is triggered when the CPU load is above 80% in a single logical processor (hardware thread) of a device for more than 30 seconds. This threshold has demonstrated to be somewhat low for the high capacity of modern CPUs with multiple cores. For instance, a quad-core device with hyper-threading technology has two hardware threads per core, making a total of 8 logical processors (threads) and a capacity of 800%. Thus, a load of 80% represents only 10% of the total capacity of the CPU, which is certainly not very significant.

The second warning, High overall CPU usage, takes into account the total capacity of the CPU in a device. It is triggered when the CPU load is above 70% over all the logical processors combined for more than 30 seconds. That is, the threshold is 70% over a normalized CPU capacity of 100%. For the same quad-core device as discussed in the example above, that would mean a 560% load over 800% of total capacity, which is indeed a high CPU load.

Aggregates on CPU usage warnings

For the previous warning events, two aggregates let you know the percentage of time that devices are under a high CPU condition. There is also a similar aggregate for applications:

Typically, the aggregate High device thread CPU time ratio (deprecated) displays higher ratios of time spent by devices under a high CPU condition. Those ratios may be unrealistically high for devices with multiple-core CPUs for the same reasons as explained in the table above. Preferably use the aggregate High device overall CPU time ratio.

The aggregate High application thread CPU time ratio lets you find applications with high CPU consumption or, when applied to binaries, compare the different versions of the same application and see which one stays longer in a high CPU condition.