topic How can I alert if this PID changes on 3k machines? in Alerting

How can I alert if this PID changes on 3k machines?

daniel333 — Tue, 22 May 2018 19:58:41 GMT

All,

I have about 4k hosts collecting PS data. What I would like to do is get a dashboard or alert when the PID for SSHD changes. I really have no idea how to compare that many collections to their previous ones like that.

I got this far...
sourcetype=ps COMMAND=sshd PID=*

Re: How can I alert if this PID changes on 3k machines?

xpac — Tue, 22 May 2018 20:09:35 GMT

I'd try something like this:

| stats values(PID) AS PIDs dc(PID) AS PID_count by host
| where PID_count > 1

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂