Alert if a process IS running?

[mbeebe]

All,

Due to powers beyond my control, a certain unnameable organization within my company likes to play the role of Chaos Monkey and run processes on production servers, generally without warning anybody, that then cause said servers to crash at 3:00am. This leads to much wailing and gnashing of teeth, along with theological questions about how could a beneficent and all-seeing deity allow such things to happen without then smiting the perpetrators.

td;dr: is there a way to get an alert if a process IS running? This is on Linux and using SNMP.

Thanks,

-- Mike Beebe

[jdunitz]

I used to work somewhere where one of the admins considered "screen" a dangerous, nefarious tool, and wouldn't allow it on any system.
People would compile their own binaries and try to hide them, but eventually he'd notice.

If I were that guy, I'd be absolutely chuffed to find I could do this:

https://support.nagios.com/kb/article/p ... ss_running

Code: Select all

[screen is terminating]
[root@jpd-nagiosxi-one libexec]#  ./check_procs -C screen -c 0
PROCS OK: 0 processes with command name 'screen' | procs=0;;0;0;
[root@jpd-nagiosxi-one libexec]#

...then I start up a screen session, and:

Code: Select all

[root@jpd-nagiosxi-one libexec]# ./check_procs -C screen -c 0
PROCS CRITICAL: 2 processes with command name 'screen' | procs=2;;0;0;
[root@jpd-nagiosxi-one libexec]#

Aha!!!

How's that?
--Jeffrey

[mbeebe]

Hey Jeffrey,

Thanks for the truly awesome response!

It wouldn't work in our case, because we need SNMP over NRPE, but I did manage to figure it out.

There's a super-awesome command called "negate", which tell a check to look for the OPPOSITE of what it's checking for:

./negate -s ./check_snmp_process_wizard.pl -H <hostname> -C <community string> -n <process name> -w 0 -c 0

This tells the check command to treat any result that would be an ALERT as an OK instead.

Wonderful discovery!

(go ahead and close thread. Thanks!)


-- Mike

I used to work somewhere where one of the admins considered "screen" a dangerous, nefarious tool, and wouldn't allow it on any system.
People would compile their own binaries and try to hide them, but eventually he'd notice.

If I were that guy, I'd be absolutely chuffed to find I could do this:

https://support.nagios.com/kb/article/p ... ss_running

Code: Select all

[screen is terminating]
[root@jpd-nagiosxi-one libexec]#  ./check_procs -C screen -c 0
PROCS OK: 0 processes with command name 'screen' | procs=0;;0;0;
[root@jpd-nagiosxi-one libexec]#

...then I start up a screen session, and:

Code: Select all

[root@jpd-nagiosxi-one libexec]# ./check_procs -C screen -c 0
PROCS CRITICAL: 2 processes with command name 'screen' | procs=2;;0;0;
[root@jpd-nagiosxi-one libexec]#

Aha!!!

How's that?
--Jeffrey

[ssax]

This command will always return OK:

Code: Select all

./negate -s ./check_snmp_process_wizard.pl -H <hostname> -C <community string> -n <process name> -w 0 -c 0

I thought you wanted to check for the procesname to see if it is running and alert you if it is? The command above won't do that.