Executions

The Executions tab from Device View provides insights into every binary execution that occurred on the device in the last hour. It features the following metrics:

Binary → Name: The file name of the displayed binary.
Username: The name of the user account on the local device.
- Collector configuration is required to populate this field.
Device → Name: The name of the device as used by the operating system for identification purposes on the local network.
CPU time: The sum of the CPU time of all the underlying processes during the time bucket (last hour).
- The CPU time can be much higher than the bucket duration, as multiple processes can run in parallel on several CPU cores.
Memory used: Average memory usage of the executed binary during the time bucket, in bytes.
- This metric represents the average memory used by all processes running the same binary during the time bucket. The value is weighted by each process’s execution duration.
Page faults: The total number of page faults.
- Page faults occur when a process tries to access a part of the memory that has not yet been loaded into memory, causing degradation of system performance and execution.
Incoming traffic: The amount of incoming traffic for Transmission Control Protocol (TCP) connections only.
Outgoing traffic: The amount of outgoing traffic for TCP and User Datagram Package (UDP) connections.
Number of freezes: The number of execution freezes.
- The sampling of unresponsive applications every 30 seconds may lead to missed execution freezes.

Drilling down on specific items

You can hover over an item to display the action menu and access additional options, such as opening the Diagnostics dashboard for specific binaries or listing related items or events in Investigations. Refer to Analyzing investigations for more information.

The Actions rocket icon in the right-side panel allows you to take associated actions from the Device View page on the target device, depending on the user role permissions.