NCPA Example Search for Processes Check with Multiple Names

[onegative]

G 'Day Support,

So I am trying to utilize the ncpa processes api to monitor two named processes using the combiner argument to verify both processes exist at the same time without utilizing two independent calls.

The use of a logically "AND" here should be appropriate as it would add functionality where multiple processes establish a working set without the need for individual monitoring services. Otherwise the combiner=or as a only choice doesn't give you much in terms functionality because it doesn't return any of the combiner filters if not detected.

I would appreciate community comments regarding this revelation as it seems obvious that the functionality I describe seems reasonable.

Thanks for your attention,
Danny
@onegative

i.e.
WORKS: processes?name=oracle&name=TNSLSNR&combiner=or&match=search&check=true
RESULTS: {
"perfdata": "'process_count'=2;;;",
"returncode": 0,
"stdout": "OK: Process count for processes named oracle,tnslsnr was 2 | 'process_count'=2;;; 'cpu'=3.63%;;; 'memory'=9.75%;;; 'memory_vms'=1780064256B;;; 'memory_rss'=1673977856B;;;\nProcesses Matched\nPID: Name: Username: Exe: Memory: CPU\n-----------------------------------\n340: oracle.exe: NT AUTHORITY\\SYSTEM: 9.66 % (VMS 1767088128.00 B, RSS 1658781696.00 B): 3.63 %\n1960: TNSLSNR.EXE: NT AUTHORITY\\SYSTEM: 0.09 % (VMS 12976128.00 B, RSS 15196160.00 B): 0.00 %\n\nTotal Memory: 9.75 % (VMS 1780064256.00 B, RSS 1673977856.00 B)\nTotal CPU: 3.63 %\n"
}

DOES NOT WORK: processes?name=oracle&name=TNSLSNR&combiner=and&match=search&check=true
RESULTS: {
"perfdata": "'process_count'=0;;;",
"returncode": 0,
"stdout": "OK: Process count for processes named oracle,tnslsnr was 0 | 'process_count'=0;;;"
}

[jdunitz]

I'm looking into this, but I believe "or" is the only logical operand that's provided.

--Jeffrey

[jdunitz]

The way this works is the "and" is for testing two parameters on the same process, like perhaps username and process name, like so:

Code: Select all

 curl -k https://localhost:5693/api/processes?token=mytoken\&username='apache'\&name='httpd'\&combiner=and\&match=search\&check=true
{
    "returncode": 0,
    "stdout": "OK: Process count for processes named httpd was 10 | 'process_count'=10;;; 'cpu'=6.15%;;; 'memory'=23.98%;;; 'memory_vms'=6.06GB;;; 'memory_rss'=0.45GB;;;\nProcesses Matched\nPID: Name: Username: Exe: Memory: CPU\n-----------------------------------\n1325: httpd: apache: 3.69 % (VMS 0.63 GB, RSS 0.07 GB): 0.05 %\n1329: httpd: apache: 3.86 % (VMS 0.63 GB, RSS 0.07 GB): 0.00 %\n1721: httpd: apache: 2.31 % (VMS 0.61 GB, RSS 0.04 GB): 2.05 %\n10647: httpd: apache: 3.84 % (VMS 0.63 GB, RSS 0.07 GB): 2.05 %\n18540: httpd: apache: 1.52 % (VMS 0.59 GB, RSS 0.03 GB): 0.00 %\n34092: httpd: apache: 1.45 % (VMS 0.59 GB, RSS 0.03 GB): 0.00 %\n34093: httpd: apache: 1.62 % (VMS 0.59 GB, RSS 0.03 GB): 2.00 %\n34094: httpd: apache: 1.57 % (VMS 0.59 GB, RSS 0.03 GB): 0.00 %\n34787: httpd: apache: 2.11 % (VMS 0.60 GB, RSS 0.04 GB): 0.00 %\n34820: httpd: apache: 2.01 % (VMS 0.60 GB, RSS 0.04 GB): 0.00 %\n\nTotal Memory: 23.98 % (VMS 6.06 GB, RSS 0.45 GB)\nTotal CPU: 6.15 %\n"
}

That way, if you had another set of httpd's running as a different user or something, you could narrow it down.
But what you're wanting to do isn't going to work how you think:

Code: Select all

name=onething&name=somethingelse&combiner=and

is actually looking for a process that has two names at the same time, which of course can't be done.

I tried various things using a regex as the search, but was not able to find something that worked.

So, I think you'll have to do this with two calls after all.

Hope that helps!

--Jeffrey

[onegative]

By default the combiner is defined as a logical "AND" as seen by the use of multiple filters like name & exe.
i.e. Process table

Code: Select all

{
    "processes": [
        {
            "username": "NT AUTHORITY\\SYSTEM",
            "mem_percent": [
                9.55,
                "%"
            ],
            "exe": "F:\\u01\\Datastore\\ora10g\\db_1\\BIN\\oracle.exe",
            "name": "oracle.exe",
            "cpu_percent": [
                0.72,
                "%"
            ],
            "mem_vms": [
                1757003776,
                "B"
            ],
            "cmd": "f:\\u01\\datastore\\ora10g\\db_1\\bin\\ORACLE.EXE CHECKPDS",
            "pid": 340,
            "mem_rss": [
                1640861696,
                "B"
            ]
        }
    ]
}

So if you specify the following: processes?name=oracle&exe=ora10g&match=search&check=true

RESULTS:
{
"perfdata": "'process_count'=1;;;",
"returncode": 0,
"stdout": "OK: Process count for exes named ora10g and processes named oracle was 1 | 'process_count'=1;;; 'cpu'=1.43%;;; 'memory'=9.39%;;; 'memory_vms'=1723154432B;;; 'memory_rss'=1612505088B;;;\nProcesses Matched\nPID: Name: Username: Exe: Memory: CPU\n-----------------------------------\n340: oracle.exe: NT AUTHORITY\\SYSTEM: 9.39 % (VMS 1723154432.00 B, RSS 1612505088.00 B): 1.43 %\n\nTotal Memory: 9.39 % (VMS 1723154432.00 B, RSS 1612505088.00 B)\nTotal CPU: 1.43 %\n"
}

Obviously the logical AND works against two different filters for one process. In this case it tells you the correct version of the oracle executable is being run.

But if you try and specify multiple processes by using name AND name it doesn't. Just seems logical that if you can specify name OR name, that name AND name should also be available...

At least that is how I believe it should work because then you could combine multiple processes together into a single monitor.

Anyway, I just wanted to get some feedback and perhaps insight from the developers regarding why name OR name is allowed but not name AND name...

Thanks,
Danny
@onegative

[ssax]

The guide lists you need to use &combiner=or to search for multiple processes.

https://www.nagios.org/ncpa/help.php#ap ... -processes

While I can also see your point of view it doesn't currently work that way (development would need to adjust it), you can submit a feature request here to the developers:

https://github.com/NagiosEnterprises/ncpa/issues

[onegative]

Thanks for the feedback...please lock this post.

I was just looking for a way to combine multiple different process names into a single call. I can of course write my own process plugin to accomplish I was looking for a built-in way to shorten to work load and maintenance.

Thanks again y'all,
Danny