Hardware FixRecommendedDevice not working? Your driver may be the problemCheck updates for common hardware issues.Fix DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PC×
Skip to content
World desk4 min

How to Monitor GPU and CPU Usage for Unauthorized Cryptomining on AI Servers

Learn how to baseline AI workloads, monitor GPU and CPU signals, attribute usage to jobs and processes, and investigate anomalies that could indicate unauthorized cryptomining.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Monitor GPU and CPU activity against a baseline of authorized AI workloads, then investigate sustained usage that cannot be matched to a known job, process, or deployment. Utilization alone cannot tell you that a miner is running: correlate device metrics with scheduler and container identity, host and security logs, and cloud resource usage before drawing a conclusion.

What usage monitoring can—and cannot—tell you

GPU and CPU telemetry can reveal activity that is unusual for a server, but it cannot by itself identify cryptomining. Training, inference, data processing, and other legitimate workloads can also use substantial compute. NVIDIA notes that DCGM profiling metrics are interval averages; a high reading does not establish which workload caused it, and the metrics do not identify the kernel or source line responsible for activity.

As an Amazon Associate I earn from qualifying purchases.

There is no universal utilization threshold that proves unauthorized mining. Set expectations for each server and workload, and treat unexplained or out-of-schedule activity as an investigation trigger rather than a verdict.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Build a baseline for authorized AI work

Record which GPU, host, container, user, and scheduler job should be active, and when. Measure representative phases of training and inference rather than relying on one system-wide utilization figure. Keep deployment and workload records available so an alert can be checked against approved activity.

#1 Best Overall
Thermal Grizzly WireView Pro II 12V-2x6 GPU Power Meter Normal
  • CHECK COMPATIBILITY BEFORE PURCHASE: This product is only compatible with specific models. Please review the Compatibility List in the A+ Content below before ordering to ensure your device/model is supported.
  • GPU POWER METER FOR 12V-2X6 CONNECTIONS – WireView Pro II monitors graphics-card power delivery directly at the GPU cable path.
  • HARDWARE-BASED MONITORING WITHOUT REQUIRED SOFTWARE – Shows key values directly on the display, with optional software use.
  • EXTENDED 2-YEAR WARRANTY - For qualifying damage to the 12VHPWR or 12V-2x6 connector, Thermal Grizzly provides repair or, if repair is not possible, an equivalent replacement
  • DESIGNED FOR ADDITIONAL PC SAFETY – Supports early detection of abnormal power behavior on compatible 12V-2x6 GPU setups.
  • Map each GPU to its host and the workloads permitted to use it.
  • Record job start and end times, scheduler identity, container, user, and expected resource use.
  • Capture representative behavior across workload phases, including idle periods where applicable.
  • Keep deployment changes and ordinary job records alongside monitoring data.

Collect GPU and host CPU telemetry

NVIDIA data-center GPUs

NVIDIA Data Center GPU Manager (DCGM) can expose graphics-engine activity, streaming multiprocessor (SM) activity, memory-bandwidth activity, and PCIe or NVLink traffic. DCGM profiling documentation describes a default sampling cadence of 1 Hz, with configurable query frequency; available metrics vary by hardware. Profiling counters require appropriate administrator privileges, and some counters cannot be collected simultaneously on some GPUs. Collection can also conflict with NVIDIA developer profiling tools such as Nsight Systems or Nsight Compute. See NVIDIA’s DCGM feature overview and profiling documentation.

CPU and Kubernetes metrics

Choose CPU telemetry for the actual host platform; DCGM is not a general CPU monitor for every AI server. NVIDIA documents DCGM CPU monitoring for Grace CPUs, including total, user, nice, system, and interrupt utilization, starting with DCGM 3.3. In NVIDIA’s documented Kubernetes monitoring architecture, node_exporter provides node-level metrics such as CPU utilization, while DCGM Exporter exposes GPU metrics to Prometheus. See NVIDIA’s GPU telemetry overview.

Rank #2
Thermalright Trofeo Vision LCD AIO Display 9.16” PC Monitor
  • 9.16” Wide LCD Screen – Features a crisp 1920×480 resolution display, perfect for showcasing system stats, hardware performance, or personalized visuals inside your gaming PC.
  • Real-Time Hardware Monitoring – Easily track CPU/GPU temps, fan speed, memory usage, and more, giving you complete control of your system health at a glance.
  • TRCC Software with DIY Options – Includes Thermalright TRCC app with multiple preset themes and DIY customization, so you can design your own unique interface
  • Plug & Play USB-C Connection – Simple Type-C interface ensures quick setup and compatibility with most Windows systems, no complicated drivers required.
  • Compact & Stylish Build – At only L251 x W68 x H17 mm, this slim display fits seamlessly inside or outside your PC case, adding both function and aesthetic appeal for modders and enthusiasts.

For non-NVIDIA accelerators, non-Kubernetes hosts, or other monitoring stacks, use the relevant vendor’s authoritative telemetry and the host’s process-accounting tools. The sources cited here do not establish a universal cross-vendor metric mapping.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Attribute activity to a process or job

When a GPU reading is unexpected, identify who or what was using the device at that time. DCGM can report statistics for an operating-system process when its PID is known, or for a caller-defined scheduler job when scheduler instrumentation provides a job ID and time boundary. Join these observations with scheduler, container, user, and application records. NVIDIA’s process and job statistics documentation describes these reports.

DCGM GPU reports do not replace scheduler records or provide a complete picture of CPU and memory use, container isolation, or application performance. Keep those sources in the same investigation workflow. If GPU use is high but no expected process or job accounts for it, check whether process visibility or scheduler instrumentation is incomplete before treating the mismatch as evidence of compromise.

Choose a monitoring pattern that fits the server

For a Kubernetes cluster using NVIDIA data-center GPUs, NVIDIA documents a pattern in which DCGM Exporter supplies GPU metrics, node_exporter supplies node metrics, and Prometheus scrapes and stores the time series. The right choice for another environment depends on more than the metric names.

Rank #4
Thermalright Trofeo Vision LCD AIO Display 9.16” PC Monitor
  • 9.16” Wide LCD Screen – Features a crisp 1920×480 resolution display, perfect for showcasing system stats, hardware performance, or personalized visuals inside your gaming PC.
  • Real-Time Hardware Monitoring – Easily track CPU/GPU temps, fan speed, memory usage, and more, giving you complete control of your system health at a glance.
  • TRCC Software with DIY Options – Includes Thermalright TRCC app with multiple preset themes and DIY customization, so you can design your own unique interface
  • Plug & Play USB-C Connection – Simple Type-C interface ensures quick setup and compatibility with most Windows systems, no complicated drivers required.
  • Compact & Stylish Build – At only L251 x W68 x H17 mm, this slim display fits seamlessly inside or outside your PC case, adding both function and aesthetic appeal for modders and enthusiasts.
Decision What to check
Accelerator support Whether the telemetry tool supports the GPU or other accelerator model in use, and which metrics that hardware exposes.
Host support Whether CPU metrics cover the server platform; DCGM’s documented CPU fields apply to Grace CPUs.
Deployment Whether the setup matches Kubernetes, bare metal, or the environment where the workloads run.
Attribution Whether telemetry can be joined to processes, scheduler jobs, containers, users, and application records.
Operations How metrics are retained and alerted on, and what permissions, counter conflicts, or collection overhead apply.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Alert on sustained, unexplained combinations

Set alerts relative to the server’s own baseline and approved job schedule rather than applying one threshold to every machine. Useful investigation triggers include sustained GPU activity outside scheduled work, unexplained device-memory or interconnect activity, CPU use that rises without a known process, or resource and billing changes without an approved deployment.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Correlate these signals over the same time window with job identity, process activity, host and security logs, and cloud resource use. High CPU can also result from improper configuration or service-health problems; CISA recommends monitoring cloud resource usage for irregularities. See CISA’s Cloud Security Technical Reference Architecture, TIC 3.0 Cloud Use Case, and Use Logging on Business Systems.

Best Value
WOWNOVA 5" Computer Temp Monitor, Dynamic Theme Supported, ARGB PC Case Sensor Panel, IPS Type-C USB Mini Secondary Screen, CPU RAM HDD Data Monitor (Black)
  • 【Upgraded 5" with Self-developed Software】In response to some customers' needs for a larger computer temp monitor, we have developed this upgraded 5-inch pannel. The PC Temperature Display works great with our English version software. You can use this with our software as a "second monitor" to view computer's Temperature and usage of CPU, GPU ,RAM, FPS and HDD Data etc. More professional and occupy less resoures.
  • 【Dynamic Vedio Theme & Cool!!】There are a lot of cool and cute dynamic videos preset in it, and the temporary computer monitor supports customizing your own dynamic video theme. Attached 16G flash card allows you DIY more and a lots dynamic videos.
  • 【Just One USB & Great Viewing Angles】Our Computer Temp Monitor only needs the single USB-C cable so it can be mounted completely internally off a usb header without the need of a port on the GPU which is a huge plus to you. No HDMI required, no power required. Just One USB Type-C cable. IPS full view. 5inch panel screen. Display area: 1.93*2.91". Overall size: 2.17*3.35". Resolution: 800*480. Thickness: 0.39". Shell material: Aluminum Housing
  • 【Simple & Feature-rich】Image&video UI support. Customizable screen layout. Horizontal and vertial screen switching. Visual theme editor: drag the mouse arbitarily to realize your creativity. Energy saving & environmental protection. One-click operation, Auto-Start, turn off the screen automatically and Comfortable eye protection Brightness adjustment.
  • 【Continuously Updated Theme & Great Customer Service】We have professional artists and techie who continuously updated the images and videos theme. We respect and value each customer's product and service satisfaction. We want to offer you premium products for a Long-Lasting Experience. If any issue, please kindly contact us for a solution.

Investigate suspected mining as a security incident

If telemetry and process records point to a miner, broaden the review beyond GPU usage. Examine process execution, startup and persistence changes, security events, network connections, account activity, and nearby systems. In a specific federal-network incident, CISA reported that actors installed XMRig and also moved laterally, compromised credentials, and used Ngrok. That 2022 case illustrates why a miner may be one sign of a wider intrusion; it does not establish that all miners use the same tools or tactics. See CISA’s incident advisory.

For an incident like the one described in that advisory, CISA recommends isolating affected systems and collecting and reviewing relevant logs, data, and artifacts. Preserve evidence and follow your organization’s incident-response process rather than deleting suspicious files before they can be examined.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.