5 Replies Latest reply on Aug 16, 2017 8:45 AM by yaquaholic

    Pass command line in Alert for Process monitor

    san360

      Is it possible to pass the command line value for a process monitor in SAM alert?

          • Re: Pass command line in Alert for Process monitor
            yaquaholic

            Hi san360

             

            Do you mean create a batch script (containing the command)?

            Edit the (or create a new) SAM template, from http://<Orion-server>/Orion/APM/Admin/ApplicationTemplates.aspx

             

            Add a new component to the template and try using either the "Windows PowerShell Monitor" or the "Windows Script Monitor".

            Have a look at Windows PowerShell monitor  and Windows Script monitor  KBs to get you started.

            There are also some example scripts in your Program Files (x86)\SolarWinds\Orion\APM\SampleScriptMonitors folder.

             

            Is that what you meant?

              • Re: Pass command line in Alert for Process monitor
                yaquaholic

                Or in the alert Action, you can add an action to be executed, when the alert is triggered.

                This will allow you to execute a script or executable, when the alert is triggered. This can be a local file on the Orion server or a UNC path to a remote file.

                  • Re: Pass command line in Alert for Process monitor
                    san360

                    We are monitoring various processes running on windows and linux servers. I would like to be able to pass the command line value for process in alert triggered by solarwinds.

                     

                      • Re: Pass command line in Alert for Process monitor
                        yaquaholic

                        Okay, now that's a little clearer I  have had a look at this.

                         

                        I will assume that the screenshot above is from the Process Explorer, which uses WMI to get the running processes from the remote computer, giving this Task Manager like view.

                         

                        I have checked on the process monitors I have in place, and they do not reference the command line of the process, in the data tables, or not that I have located yet.

                        I suspect that the monitor uses the WMI Win32_Process class, which uses the process name and does not need to retrieve (or store) the executable full path.

                         

                        You may have to create a new monitor to retrieve this information - If anyone else has better info please chip in!

                         

                        I did some testing using Get-Process and wrote this PowerShell monitor that checks that a process (Outlook in my example) is running and if so returning the executrices path.

                         

                         

                        $procname = 'OUTLOOK'

                        $info = Get-Process -Name $procname -ErrorAction SilentlyContinue

                         

                        if (!$info)

                              {

                               Write-Host "Statistic.Process: 0"

                               Write-Host "Message.Process: $procname was not found"

                               $ExitCode = 1 # Down

                              }

                        else

                              {

                               Write-Host "Statistic.Process: 1"

                               $data = get-wmiobject win32_process -filter "name like 'Outlook%'" | select Path

                               Write-Host "Message.Process: $data"

                               $ExitCode = 0 # Up

                              }

                         

                        exit $ExitCode

                         

                         

                        Once you have created this as a component of the monitor template, we then need to work out how to retrieve the data, back into an alert.

                        I will test and come back with some advice on doing that.

                        (Unless any other thwacker has a better way to skin this cat).

                         

                        <EDIT>

                        I am struggling to get the path variable to return cleanly in the Message result, although it is working perfectly when I run it in PoweShell ISE.

                        At least this version returns a path you can read.

                        </EDIT>