Alert on unexpected process

I will be thinking of this over the weekend but wanted to throw the question out in case anyone has figured it out.

We’d like to alert if an “unexpected” process is running on a Linux server as a specific user. I have no idea what this process might be called – it could be anything. Basically I have a user that’s supposed to run 3 and exactly 3 processes with specific names… if anything else shows up, I want an alert.

thanks
Lance

Hi @lance,

it is possible to accomplish your needs. You need to create a manual check State and count of processes and there you can define upper ond lower limits for your process counts.

Hi @lance,

@tosch is right, but not complete enough… :wink:

  1. If you’re using up to CMK v1.6, you find it in “manual checks”, starting with v2.0 in “forced checks”.
  2. Create the check with parameter “name of the operating user” and set limits to “3” for all options, if always exactly 3 processes should run as this user.
  3. If you know the exact processes (not their number), I’d create two of those manual checks:
  • first like point 2 above, extended by the process matching and
  • second like first one, but this time explicitly matching all processes Not matched by first one, as well as setting levels to “0” in all options

Choosing point 3 above leads to two services:

  • first monitoring the NEEDED processes
  • second monitoring (and alarming), if user runs other - not wanted - processes of any kind…

Hope this helps,
Marsellus W.

BTW: try to provide information about used version next time, so that we directly know which hints are needed :grin:

1 Like

Thanks for the hints. I was thinking manual checks buy didn’t think it through. I do believe this will work for me.

I apologize for not specifyint the version. I was in a rush. We’re 1.6.

Hi @lance

There was this posting where one fellow forum user wanted to “catch” an unknown process that is causing high CPU load. The accepted solution was a small but powerful shell script that lists the five top processes in terms of CPU. Perhaps this could work for you as well?

Regards,
Thomas