We have a problem in our environment where sometimes a copy of Acrobat Reader will go off the rails and consume an entire core on the TS it's running on. This process is always behind the scenes, not an active window. We have had an alert set up to tell us when this happens, however, it's a pain to then have to go log into the machine and terminate the offending process. So we tried to set up an action in Alert Manager to have it kill the process, but it doesn't seem to be working. Part of the problem, it seems, is it doesn't seem possible to get the PID (Or perhaps we just missed it). As it's usually only one or two out of several running copies of reader that's misbehaving, we don't want to kill all 'AcroRd32.exe' processes, just the one or ones misbehaving. Is there some way within SAM to get the PID of the offending process, and then apply that to a taskkill.exe program execution in the Alert Manager?
What we have in there now is ' cmd.exe /C "echo "c:\windows\system32\taskkill.exe /S ${N=SwisEntity;M=Node.SysName} /PID " > c:\output.log" '
Problem being, with no PID to kill, it can't execute properly.
Any thoughts on this?