ADP connections to Unknown App(s)

Hi there,

We absolutely LOVE the new ADP feature but it has left us wanting more in the likes of information presented to the user.

One such bit of information that is lacking is the process PID used by the Unknown App(s). Without this, we wouldn't be able to tell which process the application is connecting to. We could of course remote into the machine and run netstat -anob | find "52734" to get the PID but it isn't that simple as you read on.

Here's what I mean:

Orion is connecting to svchost.exe on our domain controller. That svchost.exe instance is not already monitored and the connection metrics are therefore not present.

If I click on Start Monitoring, I am taken to the Component Monitor Wizard, which gives me the option to create a new monitor/template/component. At this point, we wish this was easier, especially since there's 30+ instances of svchost.exe running on the domain controller.

Which one do we choose? Even if selecting all of them, we might not pick the right ones if new instances of this process are created in the future.

Either way, in order for us to properly identify the process in question, we would need a PID. Is this something that could be added easily?

aLTeReGo thoughts on this?

Find more posts tagged with

adp

pid

unknown app(s)

Accepted answers

All comments

silverbacksays

My hot take on this is that because the ultimate program running behind any given svchost.exe process can change depending on how each service which is running underneath it is loaded in from the registry, the scripting that generates the association breaks. That said, I haven't seen the nuts and bolts of how this works, so it's an educated guess

serena

silverbacksays wrote:
My hot take on this is that because the ultimate program running behind any given svchost.exe process can change depending on how each service which is running underneath it is loaded in from the registry, the scripting that generates the association breaks. That said, I haven't seen the nuts and bolts of how this works, so it's an educated guess

Jez is absolutely right. A PID is assigned when the process starts, and we do store that information with ADM. However, when the process is restarted, that PID is changed, and no longer valid for the process. Many processes commonly restart (e.g IIS) and so using the PID as the unique identifier would not work. The common mappings across process will be the name and command line parameters, which ADM will track with accuracy.

Deltona

Thanks for confirming!