2 Replies Latest reply on Mar 24, 2014 5:19 PM by nicole pauls

    Process stop monitor


      There is a service.stop="service_name", but is there a process.stop="process_name" function? I'm trying to monitor a specific process running on a server and want to know when it stops. Any ideas would be welcome!

        • Re: Process stop monitor

          There is a ProcessStop event:


          2014-03-18 06_28_58-SolarWinds Log and Event Manager Console.png

          2014-03-18 06_29_54-SolarWinds Log and Event Manager Console.png


          However, I'm not sure how useful it is for critical processes.  In my lab, in the last week with both my workstation and a couple servers, I only had these 4 events and they all have to relate to Windows and Office Updates.  If you're trying to keep critical processes running, it might be worth investigating our Server and Application Monitoring (SAM) product.

          • Re: Process stop monitor
            nicole pauls

            Make sure you have process auditing enabled if you want to look for these events - it's off by default in the windows security policy.


            There's also a builtin rule about monitoring for critical server processes, which uses a list you can add to as well. (Another common one would be to look for a process OTHER than a known list to start, which could tell you when something weird is going on.)


            I have had customers use the ProcessStop to detect when a service crashes but doesn't stop... someone had some pretty nasty Exchange problems a while back that this helped spot (they saw the mailbox store process crash and used active response to restart the service).