It's common to have services running that re-use the same executable; like java or svchost.exe. Is there a way to have the application monitor "find" those applications or must we "re-monitor" them everytime the PID changes?
The way we distinguish them internally is by some peripheral value. For example we add -Duaa=tomcat strings to the java command line on unix. We know which svchost.exe to target by the ports it has open.
What strategies can you recommend for having orion behave in a similar fashion? Custom code or custom MIBs are doable...
Thoughts?