Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Application Monitor to check for one or the other processes.

Good day,

We currently have a application monitor assigned to all of our windows servers to ensure our antivirus solution is running. We are in the process of switching antivirus software and i am wondering if there is a way to take our currently existing application monitor that has a process monitor for "antivirus A: and and add a process to check for "antivirus B" and have the application monitor show that something is down only if one is not working. if that makes sense at all. I want the one application monitor assigned to all servers to only sown something is wrong with one or the other process is not working. IS that possible?

Thanks.

Find more posts tagged with

Accepted answers

All comments

morr_rva

I would imagine that you could build an alert using complex conditions to do this.

mark.gover

You can likely write a Powershell script application monitor to achieve this. Have the Powershell script check which process is running and output the running process, then write an alert based on the output.

SteveK

I don't think the application template allows for a roll up if all components are down. As @mark.gover mentioned your best bet for this would be to do a powershell based sam monitor for it.

You will need to test this out. I wrote this in the powershell editor in thwack, so there could be some formatting issues:

Try {
$ServiceCheck = Get-Service | Where-Object {$_.Name -eq "Antivirus A" -or $_.Name -eq "Antivirus B"}
} Catch {
Write-Host "Message: $($Error[0].Exception)"
Write-Host "Statistic:  0"
Exit 1
}

If (($ServiceCheck | Where-Object {$_.Status -eq "running"} | Measure-Object).count -lt 1){
  Write-Host "Message:  Antivirus is not running | $(($ServiceCheck | Where-Object {$_.Status -ne "Running").Name)"
  Write-Host "Statistic: $($ServiceCheck | Where-Object {$_.Status -eq "running"} | Measure-Object).count)"
  Exit 3
  } Else{
  Write-Host "Message:  Antivirus is currently active $(($ServiceCheck | Where-Object {$_.Status -eq "Running").Name)
  Write-Host "Statistic: $($ServiceCheck | Where-Object {$_.Status -eq "running"} | Measure-Object).count)"
  Exit 0
  }

Populate your list of AV products in the Service Check

Then if you have 0 declared AV services running, it should exit out as critical. Since it does return a statistic value, you could also set your critical/warning threshold there. Like Critical if 0, warning if 2.

Then once you get the old product removed from the environment, I would just switch back to a standard service or process monitor.

pustuleo

Thanks! this should help allot. Appreciate everyone's input on this.

mapujece

Yes, that is possible. You can configure the application monitor to use a logical OR condition for the processes—meaning it will only alert if both antivirus processes are not running. In most monitoring tools (like SolarWinds, Nagios, etc.), you can create a composite monitor or use a script that checks if either process is running—similar to how you’d compare clinics when researching something like hair transplant Turkey—and only trigger an alert if neither is found. This way, during your transition, the monitor stays green as long as at least one AV solution is active and only shows a problem if neither is running.