Question about monitor process

Hello everyone,

I am trying to monitor a Process called “shadowbot” running on my windows machine which have the checkmk windows agent installed, but the status keeps in Crit state even the program shadowbot is running, I tried the same for the Firefox also the same. The only program works for me is the notepad.exe, it shows the correct state of the program and send outs the email correctly when I turn the program off and on. I mirrored the same setting of notepad.exe to the shadowbot and firefox still no luck. I compared all 3 service, and looks only the notepad.exe has 1 process capured but shadowbot and firefox have 0 process , as I highlighted in below screen capture. I’ve tried use with or without the .exe still not work. Does you have any idea about this ?

Someone mentioned that to check the agent output process list to find out what the checmk sees the application, but I don’t know how to find out the “Agent output process list”. Any one can help on this ?

Thank you in advance!

I don’t know nothing about Windows but I would click the hamburger menu of the Check_MK service and then Download agent output.

In the received file I would search for notepad (or whatever). Maybe that helps?

Under linux the problem is often that the option “Exact name of the process…” requires the full path (like /usr/bin/firefox, for example).

Maybe try “Regular expression…” instead and use .*firefox as the pattern?

1 Like

Hi Dirk,

Where can I find that " hamburger menu of the Check_MK service" ? Thank you!

It’s the ☰-sign next to the service Check_MK:

image

(They are called hamburger menus because with very much fantasy the three bars look like a :hamburger:)

1 Like

Hi Dirk,

Thank you very much for your advice. I can find out the process name “shadwobot.shell.exe” through the agent output. But there is one more issue, even though checkmk can detect the process status is in Ok or Critical state, but it doesn’t trigger any notification when the service is changing between ok and Critical. my notification look fine with the checking of service event type ok and critical, but checking the recent notification list there is no email tigger for the the shadwobot process… Do you have any suggestion on this issue ? Thank you in advance.



This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.