Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

Passing specific data from external program to ipmonitor

Probably covered (in detail) in a way I'm not getting but:  I wrote an external program that searches a log file.  If there is a match on 3 of 5 trigger words then it searches the Windows Registry for the username within that is responsible for the matches.  I want to return that username to IPMonitor so that the oncall tech at 3am will not have to try to figure out who it is.  It sounds like the Environment Variable function only passes pass/fail type of information (at least that's how I'm reading it).  If I want the page to say, for instance, "Username: [insert username found here] has been compromised." how would I go about that?  The data between the [ ]'s is what I want to return from the external program to ipmonitor via  signal_env.exe.

2 Replies
Level 13

The External Process Monitor mostly sends up just enough data to determine pass or fail. So the use environment variables is just to transmit an expected number to compare against. What you’re looking to do is a slight bit uncommon, but it works rather well with ipMonitor. My post will show a manner in which any external program (not just programs run with the external process monitor) can send text to yourself.

How to get external applications to shuttle strings to you via ipMonitor’s alerting system.

  1. Create a content generator that will grab the entire line, except ones that begin with ‘;’. Try the following from Configuration tab > Alerts > Content generator > Add new content generator
    • Generator Name: Entire Line
    • Generator Value: %capture[1]%
  2. Create a file with notepad that you will have programs append new lines (leave it open).
  3. Next create a “File Watching” Monitor that points at this specific file (for testing purposes, have the scan frequency to 30 seconds). Try this via: Device tab > All Managed Devices > Select a Device > Add New Monitor > Windows Resources > File Watching
    • Filename: Name of the file you made with notepad
    • Directory: Path of the directory holding the file.
    • Exclusions by Line Text: ^;
    • Regex Pattern: (.*)
    • Content Generator: "Entire Line" (you created this one)
  4. Next Create an Alert for this new Monitor then an Email Action (ensure that Information Notifications is enabled on the Email Action). Try the following from Configuration tab > Alerts > Add Alert.
    • Ensure that the Alert will work on behalf of thew new File Watching Monitor.
    • Add an Email action of your choice and test it (you may have to specify an email relay server via configuration tab > system settings).
  5. With the open notepad, append a line that does not start with ‘;’ and save the file.
  6. Wait more than 30 seconds, and you should have an email with the line you just added.
Going forward any application that appends data to this file you made (that doesn’t begin with ‘;’) will cause an alert to occur.

Thanks!  That will do the trick nicely. Appreciate it.

0 Kudos