I'm monitoring a service that comes and goes, what's a good way to do this?

I need to monitor a process for memory consumption. The only problem is that the process may or may not be running. But when it’s running, I want to monitor it.

So I did create a periodic process discovery rule to make vanished services as “ok”, and it’s configured to add the “Process my-service-name” when discovered automatically (it checks every 5 minutes).

I have some questions. The periodic process discovery has an option to “add” a matching discovered service, does that also apply to vanished as well? That is, I’m not sure I want all vanished services to be “ok”, just the one “Process my-service-name”.

Hopefully that’s clear.

In sort TL;DR, I want to monitor a process that may or may not be running for memory utilization alerts when it’s running.

1 Like

What I ended up doing. I scrapped the (heavy) periodic service discovery approach. I did though maintain a global rule to not warn/crit on vanished services. Then I set a normal Process Discovery rule (for each) saying that Zero (0) processes was ok (Levels for process count).

This works pretty well. However, you manually monitor the unmonitored process as then come up… once set though, it can go up/down, etc… and yet still have a different Process Discovery setting to alert for this like memory, etc.

The ideal would be to have the monitor established even though the process doesn’t exist for all hosts of a certain selection.

1 Like

Hi,
have you tried to solve your problem with “Manual Checks -> State and count of processes”?

Karl

2 Likes

Well, I think in theory it’s the “right answer”, but I didn’t reveal everything I was doing.

What I have done is override the “ps” check such that it takes out all svchost.exe entries on Windows. And then I have a plugin deployed on the Windows side that turns all svchost.exe into the names of the services and output is a <<<ps>>> section. This works, as now we have useful names for the services and key off them instead of every Windows service being svchost.exe (which is sort of worthless).

So, while my host discovery method works using “Process discovery” rules, using a Manual check rule did not, instead for each service rule, it actually matched for all services, not what I wanted.

The “real” solution would be to fix the ps data at the Windows agent itself so that svchost.exe services are listed with their service names as their process names instead of svchost.exe. But creating my workaround is easier than compiling and deploying my own full Windows agent :slight_smile:

I would create a local check that returns the number of processes (I assume 0 or 1) and the memory utilization (0 if the process is not running).
Make the state dependent only on the memory utilization. The service will always exist so you don’t have vanished services & discovery issues.

2 Likes

I did consider this, but wanted to leverage all the “ps” check goodness already present.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.