SAM Application Discovery

Hey Thwackers,

I'm new to SAM. I see that you can take a process seen in the Real-Time Process Explorer on a node and create a new Application Monitor from it. Then you can use this new monitor and search for other running instances of this process on other nodes. Question: is there a way to just type in a process name, say DVDRipper.exe, and search for it? Or do we need to find DVDRipper.exe installed and running before we can search for others? We are interested in looking for unauthorized applications.

Find more posts tagged with

sam

application monitor

application discovery

Accepted answers

All comments

mesverrum

If you go to Applications > SAM Summary > Manage Applications > Application Monitor Templates > Create New Template > Add Component Monitor, then select either Process Monitor - SNMP or Process Monitor - WMI based on what you are polling the nodes with, then you can set up a process monitor by typing its name in. But I don't recall ever seeing anyone set it up where the application monitor goes down upon detecting the application, it just gives you the choice of taking it down when the process is not running, or ignoring it when the process is down. I think the way I would set this up would be to set it so "Status When Process is Not Running" option to Not Running, and then set the memory and CPU critical thresholds to being anything greater than 0. That SHOULD allow you to apply the monitor and have it not show as a down app under what you would consider to be normal circumstances but if it detects the application and it uses any cpu or memory at all then it would trigger the component as being critical.

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

brentbo

Hey Marc,

Thanks for the reply. Incidentally, I was talking about employment to Loop1 at one point, though other things came up. Sorry to be so obtuse, but I'm one of those simpletons who works mostly on the network side.

When I select Process Monitor WMI....

....I get prompted for an IP address.

I'm sure I'm missing something completely obvious. Thanks for your patience. Oh, and thanks for your other observations. We're currently using Nagios and SAM seems great. But I'm starting to sense that detecting unauthorized applications, running or not, might better be done with another application, perhaps patch management. Any observations you can share would be appreciated very much.

Thanks again,

Brent

mesverrum

Another method, if you don't want to waste lots of SAM licenses on this, would be to enable asset inventory on all your servers (which you probably want to do anyway) and then set up a custom report that lists out any server with contraband software installed on it. This wouldn't catch things that don't add themselves to add/remove so it's not as useful for this kind of real-time notification, but most environments don't seem to have the unlimited SAM licensing that they want to use on monitoring apps like this.

A daily custom sql report with something like

SELECT n.caption, s.name, s.version, s.installdate from [dbo].[AssetInventory_Software] s join nodes n on n.nodeid=s.nodeid where s.name like '%ripper%'

would work for most people, just add in

or s.name like whatever

for each piece of software you are concerned about.

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

mesverrum

Ah you are using the wizard, that's the long way around for this you just want to hit Manage applications from the main SAM page

That should get you about to where I was point you

brentbo

Got it! Thanks.

brentbo

Bonus! I'll experiment with this. Thanks again.