Hi List,
I have in certain situations run the windows check_mk agent(1.2.6p16) as a domain user, which was also added to local Administrator group for the local server. The reason being there were certain file shares that I needed to access that
required AD permissions.
This all worked fine, or so I thought, but after needing to add some process monitoring for a server that was running the agent under the domain account, I found that the only process information returned by the agent was for processes
owned by the domain the agent was running under, hence I had no process info for the local
\NT Authority\LOCAL or SYSTEM or NETWORK. (see below, usernames masked out)
Anyone else come across this issue, or how to maybe get round it??
Agent <<>> output when run as domain account;-
<<ps:sep(9)>>
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,124868,308,0,2332,4024,12343750,9687500,225,11) shstat.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,86588,7172,0,25332,1892,2031250,2343750,223,8) rdpclip.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,516804,112344,0,25856,56280,45625000,48750000,1602,51) explorer.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,89068,7380,0,26308,3636,1093750,156250,163,4) taskhostex.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,770280,71860,0,22300,93744,20781250,4218750,427,11) ServerManager.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,105032,9836,0,25788,3056,4843750,2187500,155,4) vmtoolsd.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,234092,24196,0,26552,20812,3906250,937500,337,9) SCNotification.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,166328,6764,0,26008,6444,2031250,2500000,246,8) rundll32.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,187324,13980,0,26180,6928,5468750,3593750,204,4) mmc.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,725572,21732,0,26396,48020,9218750,5468750,488,18) mmc.exe
(\MANINVESTMENTS\xxxxxxxxxxxxxxx,186288,13840,0,24348,6876,4843750,3750000,204,4) mmc.exe
(\MANINVESTMENTS\xxxxxxx,37164,5036,0,22516,3812,51093750,15781250,165,5) check_mk_agent.exe
(\MANINVESTMENTS\xxxxxxx,32316,5896,0,26184,3492,0,0,35,2) conhost.exe
(SYSTEM,0,0,0,0,0,0,0,0,1) System Idle Process
Agent <<>> output when run under as Local System;-
<<ps:sep(9)>>
(\NT AUTHORITY\SYSTEM,40840,3820,0,456,1048,781250,4843750,79,1) wininit.exe
(\NT AUTHORITY\SYSTEM,52216,26048,0,484,2612,937500,3593750,118,2) winlogon.exe
(\NT AUTHORITY\SYSTEM,47736,38644,0,552,7548,5396875000,3558281250,1172,8) lsass.exe
(\NT AUTHORITY\SYSTEM,45032,33412,0,612,4984,784843750,782968750,462,10) svchost.exe
(\NT AUTHORITY\NETWORK SERVICE,32476,25488,0,640,4624,5120000000,2443906250,460,10) svchost.exe
(\NT AUTHORITY\SYSTEM,142400,25592,0,740,13204,1562500,2187500,326,8) LogonUI.exe
(\NT AUTHORITY\LOCAL SERVICE,60832,43968,0,748,16764,9263281250,8969843750,506,15) svchost.exe
(\Window Manager\DWM-1,87372,22428,0,764,16308,2031250,312500,183,7) dwm.exe
(\NT AUTHORITY\SYSTEM,87896,72612,0,796,14636,352187500,375000000,264,4) svchost.exe
(\NT AUTHORITY\SYSTEM,337956,170044,0,812,275696,83614218750,20832031250,2233,33) svchost.exe
(\NT AUTHORITY\LOCAL SERVICE,83708,69936,0,880,6508,49843750,42656250,656,18) svchost.exe
(\NT AUTHORITY\NETWORK SERVICE,1218688,80072,0,952,9988,423593750,320468750,588,17) svchost.exe
(\NT AUTHORITY\SYSTEM,74072,57360,0,348,5816,5781250,36875000,207,5) rundll32.exe
(\NT AUTHORITY\LOCAL SERVICE,59192,42644,0,256,9944,77031250,37343750,385,17) svchost.exe
(\NT AUTHORITY\SYSTEM,73360,65312,0,1040,3800,25312500,8281250,377,9) spoolsv.exe
(\NT AUTHORITY\SYSTEM,75548,67068,0,1112,3428,102343750,56718750,195,9) svchost.exe
(\NT AUTHORITY\LOCAL SERVICE,74252,13376,0,1156,5820,1614531250,2484531250,203,7) macmnsvc.exe
(\NT AUTHORITY\SYSTEM,63056,17068,0,1244,7200,4831250000,2790937500,230,5) masvc.exe
(\NT AUTHORITY\SYSTEM,167304,868,0,1308,66672,229062500,193593750,515,19) VsTskMgr.exe
(\NT AUTHORITY\SYSTEM,79940,580,0,1360,4772,27656250,59687500,237,11) mfeann.exe
(\NT AUTHORITY\SYSTEM,29492,4428,0,1376,1248,8593750,5937500,101,8) mfemms.exe
(\NT AUTHORITY\SYSTEM,24628,2948,0,1412,828,13750000,25625000,46,2) conhost.exe
(\NT AUTHORITY\SYSTEM,28428,4516,0,1444,2320,10468750,4843750,63,3) mfevtps.exe
(\NT AUTHORITY\SYSTEM,44852,9312,0,1476,6508,86093750,411406250,240,5) mfevtps.exe
….
……
……
···
Mark Dollemore
Global Operations
Tel +44 20 7144 3749
Mob 07762893260
Man Group UK Limited |
Registered address: Riverbank House, 2 Swan Lane, London EC4R 3AD, United Kingdom
Registered in England and Wales no. 5856654
Visit us at:
www.man.com