Monitor a Windows service with Threshold value

[RIDS_I2MP]

Hi Team,

We have a service running in our Windows servers which needs to be monitored from Nagios end as below:

"If snare service utilised 15%CPU ,Nagios should send an alert for it."
On our Windows servers, a snare agent is installed and snare service is running for it.

So, we want Nagios monitor the snare service and if it uses 15% CPU, Nagios should send alert.

Please let me know if you need any other details and help us on this requirement.

Thanks!!

[mbellerue]

The best way to do this is probably with an agent like NCPA (https://www.nagios.org/ncpa/). With NCPA you can monitor processes in memory, which includes services. Attached is a screenshot where I search for the LocalSystemNetworkRestricted service specifically. This will allow you to alert based on CPU utilization.

[RIDS_I2MP]

Hello,

Thanks for your response!!

We have NSC++ installed on all systems. So, is it possible to do with NSC++ agent?
If not, do we need to remove NSC++ nad install NCPA?
Do we have option to use NCPA and NSC++ both in same host?

Please let me know what is the best way to do it.

Thanks

[mbellerue]

It looks like NSClient++ does have a way to monitor processes, and a way to monitor services. However, I don't know that these would work for what you are trying to do. The monitor process feature looks like it is searching for a specific executable and that's it, but all services run under the svchost.exe umbrella. So we can't use that. And the monitor services feature looks like it is only checking to see if a service is in a running state or not. I could be mistaken in this, however. I'm not an NSClient expert. If you want to read more on these two features, here are the links.
https://docs.nsclient.org/reference/win ... ck_service
https://docs.nsclient.org/reference/win ... ck_process

I do know that we can do what you need to do with NCPA. NCPA can run on the same system as NSClient without issue. NSClient uses ports 5666, 5667, and 12489 for its services. NCPA uses 5693. I have had both running on a Windows Server 2016 system for a good long while now. But as always, every environment is different. It's always a good practice to install new software to a test environment to make sure it doesn't conflict with anything else you might be running.

[RIDS_I2MP]

Hello,

Thanks for your inputs

We need approvals to open 5693 port. Once we get the approval, we will work on it.
Kindly, keep this topic open for now.

[scottwilkerson]

Hello,

Thanks for your inputs

We need approvals to open 5693 port. Once we get the approval, we will work on it.
Kindly, keep this topic open for now.

Sounds good!