You are here

Windows Agent Count Processes

4 posts / 0 new
Last post
Steve Thomas
sthomas@rpstechnologysolutions.co.uk's picture
Windows Agent Count Processes

Hi,

 

Looking for some help on how I can count the number of a certain process on Windows via agent. This is similar but don't know how to configure the ini files to make it work...

http://forums.nsclient.org/t/check-number-of-process-with-nrpe-and-checksystem/3676

 

Any help greatfully appreciated.

Steve

Duncan Ferguson
dferguson's picture
The configuration for a stock

The configuration for a stock NSClient 0.4.x should look something like:

[/settings/default]
; password = password
allowed hosts = 127.0.0.1,::1,192.168.71.220

[/settings/NRPE/server]
allow arguments = true
allow nasty characters = true
verify mode = none
insecure = true

[/settings/external scripts]
allow arguments = true
allow nasty characters = true

[/modules]
CheckExternalScripts = 1
CheckHelpers = 1
CheckEventLog = 1
CheckNSCP = 1
CheckDisk = 1
CheckSystem = 1
NRPEServer = 1

And the command to monitor the processes will be like:

/usr/local/nagios/libexec/check_nrpe -H 192.168.71.162 -c check_process -a "process=cmd.exe" "warn=count>2" "crit=count>3"

This seems to work on my test environment without issue. I'd expect our Opsview Agent to work the same as well, except the "check_process" command is actually called "nsc_checkprocstate". It should take all the same arguments.

Duncs

srthomas
srthomas's picture
Hi,

Hi,

 

The opsview Agent file layout seems different to that... I have CheckSystem.dll listed under [modules] but no handler defined messages.

Can't see where check_process is mapped to CheckSystem.dll???

Confused :$

wannunciata
wannunciata's picture
Both the Opsview Agent and

Both the Opsview Agent and NSClient 4.x have some built in functions. With the Opsview Agent it looks like it manually specifies the DLLs that contain the checks, you shouldn't need to worry about having handlers defined for them since they're pulled out of the DLLs automatically. The key to getting this to work with the Agent is to make sure your "check_nrpe" command is valid.

Also, keep in mind that the Opsview Agent is an older version of NSClient, so some references to built in functions can be found here: https://docs.nsclient.org/0.4.4/reference/windows/CheckSystem.html

Just look for the "legacy" versions of the commands. Ones built into Opsview Agent are prepended with "nsc_". So, for example, checkprocstate will be "nsc_checkprocstate". I had a little bit of time to test this out on a system here and it looks like your command should be:

./check_nrpe -H 192.168.71.162 -c nsc_checkprocstate -a 'MaxCritCount=3 MaxWarnCount=2 cmd.exe'

This works for the command "cmd.exe". You can just change the values of critical, warning, and the process name for your use. Be sure to keep the order of the arguments (everything after the -a) the same, it turns out they need to be specified in a particular order to get things working. I believe you can also do multiple commands by following this format:

MaxCritCount=2 MaxWarnCount=1 process1.exe MaxCritCount=3 MaxWarnCount=2 process2.exe

It's worth noting that this will alert as "critical" if the process is not running at all. You can possibly get around this using the "MinCritCount" arguments available, but I haven't tested this.

Hope this helps!