System Monitoring with psutil

By the end of this lesson you can:

• Enumerate processes with psutil and read their details.
• List active network connections and map them to processes.
• Watch CPU/memory/disk to spot resource abuse (e.g. crypto-mining).
• Build a host snapshot you can baseline and diff for anomalies.

A compromised machine usually behaves differently: a process you don't recognise eating 100% CPU (a miner), an outbound connection to a strange IP (a beacon to a command server), a binary running from /tmp. The OS exposes all of this — you just have to look.

Enumerate processes

import psutil       # pip install psutil

for proc in psutil.process_iter(["pid", "name", "username", "cpu_percent"]):
    info = proc.info
    print(f"{info['pid']:>6} {info['username'] or '?':12} {info['name']}")

# inspect one process in detail
p = psutil.Process()              # current process (or pass a pid)
print(p.name(), p.exe(), p.cmdline())     # what it is + how it was launched
print("opened files:", p.open_files()[:3])
print("parent:", p.ppid())                # process lineage matters for forensics

For security, the revealing fields are exe() (where the binary lives — /tmp is suspicious), cmdline() (the full launch command — miners often have tell-tale args), username() (running as root?), and ppid() (who started it).

Network connections — who is this machine talking to?

import psutil

for conn in psutil.net_connections(kind="inet"):
    if conn.status == "ESTABLISHED" and conn.raddr:
        local = f"{conn.laddr.ip}:{conn.laddr.port}"
        remote = f"{conn.raddr.ip}:{conn.raddr.port}"
        # map the connection back to the process that owns it
        owner = psutil.Process(conn.pid).name() if conn.pid else "?"
        print(f"{owner:15} {local} → {remote}")

This is gold for detection: an unexpected outbound connection (especially from an odd process to a strange IP/port) can be a malware beacon phoning home to a command-and-control server. Mapping conn.pid to the process tells you what is talking.

Resource use — spot abuse

import psutil

print("CPU %:", psutil.cpu_percent(interval=1))
print("memory %:", psutil.virtual_memory().percent)
print("disk %:", psutil.disk_usage("/").percent)

# top CPU consumers — a 100%-CPU mystery process is a classic miner sign
procs = [(p.info["cpu_percent"], p.info["name"], p.info["pid"])
         for p in psutil.process_iter(["name", "cpu_percent"])]
for cpu, name, pid in sorted(procs, reverse=True)[:5]:
    print(f"{cpu:5.1f}%  {name} (pid {pid})")

Sustained high CPU from an unknown process is the signature of crypto-mining malware; unexpected disk filling can be data staging before exfiltration. Resource monitoring catches abuse that doesn't open ports.

A few more useful calls

psutil.users()              # who is logged in (suspicious logins?)
psutil.boot_time()          # when the system started
psutil.net_io_counters()    # bytes sent/received (exfil = high outbound)
p.connections()             # connections owned by one process

Goal: capture a structured snapshot of the host — processes, listening ports, established connections, resource use — that you can save as a baseline and later diff to spot what's new (the seed of Lesson 23's anomaly detection).

import psutil, json
from datetime import datetime

def snapshot() -> dict:
    procs = []
    for p in psutil.process_iter(["pid", "name", "username", "exe"]):
        try:
            procs.append({"name": p.info["name"],
                          "user": p.info["username"],
                          "exe": p.info["exe"]})
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue                       # processes come and go / need privileges

    listening = sorted({c.laddr.port for c in psutil.net_connections("inet")
                        if c.status == "LISTEN"})

    established = []
    for c in psutil.net_connections("inet"):
        if c.status == "ESTABLISHED" and c.raddr:
            established.append({"remote": f"{c.raddr.ip}:{c.raddr.port}",
                                "pid": c.pid})

    return {
        "captured": datetime.now().isoformat(),
        "process_names": sorted({p["name"] for p in procs}),
        "listening_ports": listening,
        "established_remotes": sorted({e["remote"] for e in established}),
        "cpu_percent": psutil.cpu_percent(interval=1),
        "mem_percent": psutil.virtual_memory().percent,
    }

snap = snapshot()
print(f"{len(snap['process_names'])} distinct processes")
print("listening ports:", snap["listening_ports"])
print("outbound to:", snap["established_remotes"][:5])
print(f"CPU {snap['cpu_percent']}%  MEM {snap['mem_percent']}%")

# save as a baseline of 'normal':
with open("host_baseline.json", "w") as f:
    json.dump(snap, f, indent=2)

142 distinct processes
listening ports: [22, 631, 3000, 5432]
outbound to: ['140.82.121.4:443', '142.250.66.78:443']
CPU 8.3%  MEM 47.0%
process names + ports + remotes saved → host_baseline.json

Read the code

This snapshot is a security-relevant fingerprint of the running host: what processes exist, what's listening, who it's talking to, and how loaded it is. Note the try/except around process access — processes vanish mid-iteration and some need privileges, so robust monitoring tolerates that. Captured at a known-good moment, this becomes a baseline of normal; in the next lesson we diff a fresh snapshot against it to flag anything new — a process that appeared, a port that opened, a strange remote address. That diff is host-based anomaly detection.

psutil is your window into a live host: process_iter enumerates processes (with the security-revealing exe, cmdline, username, ppid), net_connections maps active connections to their owning process (spotting beacons to command servers), and CPU/memory/disk calls reveal resource abuse like crypto-mining. Capture a structured snapshot at a known-good moment to baseline "normal," then diff later snapshots for anomalies (next lesson). Monitoring detects — always investigate before acting, tolerate false positives, and only on systems you administer.