Alert when Windows process IS running

[hillhealthcenter]

I'm monitoring some Windows servers. I need to be alerted when a process IS running instead of when the process is not running. How do I do that?

[rkennedy]

Assuming NSClient++ is already on the machine, with NRPE enabled, you can use check_process and just match the ok. For example -

Code: Select all

[root@localhost libexec]# ./check_nrpe -H 192.168.5.47 -c check_process -a "process=iexplore.exe" "critical=count>1" "ok=count=0" "warning=count>1"
OK: all processes are ok.|'count'=1;1;1

[root@localhost libexec]# ./check_nrpe -H 192.168.5.47 -c check_process -a "process=iexplore.exe" "critical=count>1" "ok=count=0" "warning=count>1"
CRITICAL: iexplore.exe=started|'count'=2;1;1

The first check is when the process isn't running, and the second is after opening iexplore.exe. Is that what you were looking for?

[hillhealthcenter]

Yes. However, I am getting an error when I test the command from the XI command line.

[root@nagiosxi libexec]# ./check_nrpe -H 192.168.102.95 -c check_process -a "process=iexplore.exe" "critical=count>1" "ok=count=0" "warning=count>1"
Request command contained illegal metachars!
[root@nagiosxi libexec]#

[mcapra]

You will need to configure your NSClient++ to accept the metachars:
http://docs.nsclient.org/0.4.2/faq/inde ... characters

Include the following definitions in your NSClient++ configuration:

Code: Select all

[/settings/NRPE/server]
allow nasty characters=true

[/settings/external scripts]
allow nasty characters=true

If the [/settings/NRPE/server] or [/settings/external scripts] section already exist, just add the allow nasty characters=true definition under them. These definitions might also be slightly different between NSClient++ versions. If you run into issues, please share your NSClient++ version with us.

[hillhealthcenter]

I have a different error now.
"Unknown: Ne handler for that command."

We're using NSClient++ version 0.4.0.172

[Box293]

I'm pretty sure you need a newer version of NSClient++, the version you have is very old and I suspect that command is not implemented. Update to the latest 0.4.4.x version:

http://nsclient.org/download/

[hillhealthcenter]

Thanks Troy,

We'll get the NSClient++ updated. However, it seems that the "check_process" coommand isn't on our XI server. Can you send me the link? Or, point in the right direction?

[rkennedy]

Thanks Troy,

We'll get the NSClient++ updated. However, it seems that the "check_process" coommand isn't on our XI server. Can you send me the link? Or, point in the right direction?

You don't need a check_process command defined on your XI server, you'll just be using check_nrpe, and defining 'check_process' in the $ARG#$ variable that corresponds after -a. check_process is built into newer versions of NSClient++, so after updating it should work as expected.

Were you able to get it working the way you'd like it to?

[hillhealthcenter]

It might be a bit before I have a chance to test. We'd like to possibly use your recommendation to trouble a company-wide problem. I'm trying to push your recommendation through our change management process.

[mcapra]

Let us know if there's any updates!