Page 1 of 3
Alert when Windows process IS running
Posted: Thu Aug 04, 2016 4:34 pm
by hillhealthcenter
I'm monitoring some Windows servers. I need to be alerted when a process IS running instead of when the process is not running. How do I do that?
Re: Alert when Windows process IS running
Posted: Thu Aug 04, 2016 4:56 pm
by rkennedy
Assuming NSClient++ is already on the machine, with NRPE enabled, you can use check_process and just match the ok. For example -
Code: Select all
[root@localhost libexec]# ./check_nrpe -H 192.168.5.47 -c check_process -a "process=iexplore.exe" "critical=count>1" "ok=count=0" "warning=count>1"
OK: all processes are ok.|'count'=1;1;1
[root@localhost libexec]# ./check_nrpe -H 192.168.5.47 -c check_process -a "process=iexplore.exe" "critical=count>1" "ok=count=0" "warning=count>1"
CRITICAL: iexplore.exe=started|'count'=2;1;1
The first check is when the process isn't running, and the second is after opening iexplore.exe. Is that what you were looking for?
Re: Alert when Windows process IS running
Posted: Fri Aug 05, 2016 10:37 am
by hillhealthcenter
Yes. However, I am getting an error when I test the command from the XI command line.
[root@nagiosxi libexec]# ./check_nrpe -H 192.168.102.95 -c check_process -a "process=iexplore.exe" "critical=count>1" "ok=count=0" "warning=count>1"
Request command contained illegal metachars!
[root@nagiosxi libexec]#
Re: Alert when Windows process IS running
Posted: Fri Aug 05, 2016 10:42 am
by mcapra
You will need to configure your NSClient++ to accept the metachars:
http://docs.nsclient.org/0.4.2/faq/inde ... characters
Include the following definitions in your NSClient++ configuration:
Code: Select all
[/settings/NRPE/server]
allow nasty characters=true
[/settings/external scripts]
allow nasty characters=true
If the
[/settings/NRPE/server] or
[/settings/external scripts] section already exist, just add the
allow nasty characters=true definition under them. These definitions might also be slightly different between NSClient++ versions. If you run into issues, please share your NSClient++ version with us.
Re: Alert when Windows process IS running
Posted: Fri Aug 05, 2016 3:52 pm
by hillhealthcenter
I have a different error now.
"Unknown: Ne handler for that command."
We're using NSClient++ version 0.4.0.172
Re: Alert when Windows process IS running
Posted: Mon Aug 08, 2016 3:00 am
by Box293
I'm pretty sure you need a newer version of NSClient++, the version you have is very old and I suspect that command is not implemented. Update to the latest 0.4.4.x version:
http://nsclient.org/download/
Re: Alert when Windows process IS running
Posted: Mon Aug 08, 2016 9:15 am
by hillhealthcenter
Thanks Troy,
We'll get the NSClient++ updated. However, it seems that the "check_process" coommand isn't on our XI server. Can you send me the link? Or, point in the right direction?
Re: Alert when Windows process IS running
Posted: Mon Aug 08, 2016 10:03 am
by rkennedy
hillhealthcenter wrote:Thanks Troy,
We'll get the NSClient++ updated. However, it seems that the "check_process" coommand isn't on our XI server. Can you send me the link? Or, point in the right direction?
You don't need a check_process command defined on your XI server, you'll just be using check_nrpe, and defining 'check_process' in the $ARG#$ variable that corresponds after
-a. check_process is built into newer versions of NSClient++, so after updating it should work as expected.
Were you able to get it working the way you'd like it to?
Re: Alert when Windows process IS running
Posted: Tue Aug 09, 2016 9:47 am
by hillhealthcenter
It might be a bit before I have a chance to test. We'd like to possibly use your recommendation to trouble a company-wide problem. I'm trying to push your recommendation through our change management process.
Re: Alert when Windows process IS running
Posted: Tue Aug 09, 2016 12:58 pm
by mcapra
Let us know if there's any updates!