check_procs ignore/exclude specific process

[MacGuyInNC]

Hey, everyone,

I have our Nagios Core server checking a remote client using NRPE. One of the commands is the following:

/opt/local/libexec/nagios/check_procs -w 70 -c 90 --metric=CPU

The only catch is that periodically, there is a java process that will kick up to almost 100% on a multi-core machine, and this is considered normal. I'd like to not get alerted to that process unless it truly runs away (I'll specify a different command to monitor it), but am having troubles finding a way to do that. Does anyone have any suggestions? I've tried adding --ereg-argument-array='^/(?!java)' to the end of the command, but I only get a return of "PROCS UNKNOWN: Could not compile regular expression - Invalid preceding regular expression."

Any suggestions?

TIA!

[rhassing]

Is the java proces running for a long time, or does it stop after a while?

You could set your check to check multiple times before it sends out a notification.
That way you will keep track of your java proces as well.

[rkennedy]

As @rhassing mentioned -- this would be a good solution. Does the spike last very long?

I don't see an easy way to filter the result with check_procs unfortunately.

[MacGuyInNC]

It kicks up quite frequently. It's a backup server, so the java process will rev up a lot. Monitoring that process won't be helpful to me, which is why I want to exclude it.

I was planning on monitoring it separately to see if it cranks up to 200%, as 100% is considered relatively "normal."

If there's a way to use regex to search for all processes NOT matching java, that would be helpful. However, my regex knowledge kinda sucks.

[rkennedy]

That would have been my suggestion, but I don't see an exclusion with check_procs. While you could use regex to check, I don't think there is a way to exclude. -

Code: Select all

Filters:
 -s, --state=STATUSFLAGS
   Only scan for processes that have, in the output of `ps`, one or
   more of the status flags you specify (for example R, Z, S, RS,
   RSZDT, plus others based on the output of your 'ps' command).
 -p, --ppid=PPID
   Only scan for children of the parent process ID indicated.
 -z, --vsz=VSZ
   Only scan for processes with VSZ higher than indicated.
 -r, --rss=RSS
   Only scan for processes with RSS higher than indicated.
 -P, --pcpu=PCPU
   Only scan for processes with PCPU higher than indicated.
 -u, --user=USER
   Only scan for processes with user name or ID indicated.
 -a, --argument-array=STRING
   Only scan for processes with args that contain STRING.
 --ereg-argument-array=STRING
   Only scan for processes with args that contain the regex STRING.
 -C, --command=COMMAND
   Only scan for exact matches of COMMAND (without path).
 -k, --no-kthreads
   Only scan for non kernel threads (works on Linux only).

I do see quite a few other plugins available for this, at https://exchange.nagios.org/index.php?o ... check_proc - can you see if one of them will work for your needs?

[MacGuyInNC]

Alas, it doesn't appear so. Also searched for "regex" in the Exchange, but found nothing related.

I'm thinking it's just not possible. That sucks.

[rkennedy]

I wouldn't say impossible, you could always create a wrapper script for the check.

The outline would be something like -
Run check_procs
if warning/crit, check if the top process is 'java', if true then status = OK.
otherwise, report warning / critical as it would normally.

Does that make sense?