Service on Linux

Hello!
When adding a service in Linux (ds_agent) using process discovery. In my case, an antivirus is Trend Micro Deep security. I can’t manage the following

  • When it does not exist I want it to indicate an OK
  • When this service exists I want a warning

How can I do this at checkmk?

Do you want to monitor a systemd service?

No, I don´t. The service I want to monitor is called ds_agent is from an antivirus. And about this service

  • When it does not exist in a host I want it to indicate an OK

  • When this service exists en los host I want a Warning

I think this is not possible. I’ve found two rules State and count of processes in Parameters for discovered services and Process Discovery in Discovery - automatic service detection.

If you go to Process Discovery and activate the help:

Maybe you need an own check? In this case maybe a local check is enough?

Create a manual check (WATO → Manual Checks) for State and count of processes. Choose some conditions (like hostname, folder, or tags) and set the following attributes:

image

With these levels the check goes to the warning state if more than zero processes with the name /bin/sleep exists. Change that name to the name of your process, e.g. /bin/ds_agent (or whatever path makes sense).

But please be aware that the check will only go WARN if the process runs at the very moment the check_mk_agent queries the process list. I don’t know about ds_agent but if it usually runs for just a few seconds once in a while then you won’t benefit from this check.

2 Likes

Danke @Dirk :smiley: das hilft weiter

Thank very much for your answer!!

This works
image

1 Like

I would assume this goes CRIT if a process exists, not WARN as the OP asked for.

The -1 seems a bit exaggerated because it means “go CRIT if there are less than -1 processes” (i.e. -2 processes or even fewer). But that’s rather an academic problem. I would set Critical above to a value that is unlikely to occur if I only want WARNings.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.