https://community.splunk.com/t5/Splunk-Search/How-do-I-search-and-alert-on-processes-that-are-not-running-on-a/m-p/209867#M61372 <P>I have to identify processes not running on a list of hosts.<BR /> To do this, I have a lookup table with all the processes for every host and I have a script that extract ps from linux servers.<BR /> I'm able to find hosts with no running processes using the following search:</P> <PRE><CODE>| inputlookup Processes.csv |eval host=upper(host)| search host="*"| eval count=0 | append [search index=services host=*| search [| inputlookup Processes.csv | search host="*" | eval query=Process | table host query] |eval host=upper(host)| stats count by host ] | stats sum(count) AS Total by host </CODE></PRE> <P>But the problem is that I need to verify both <STRONG>host</STRONG> <EM>and</EM> <STRONG>process</STRONG> names (not only <STRONG>host</STRONG> like the previous search).<BR /> I tried to use two fields (<STRONG>host</STRONG> and <STRONG>Process</STRONG>) in the <CODE>stats count</CODE> (instead of only <STRONG>host</STRONG>) but the problem is that the <STRONG>process</STRONG> names (values) are different between lookup and events. For example, in the lookup, I have <CODE>mailman</CODE> and in ps result I have <CODE>arm_32000_--_2002_OPCMASTER_MAILMAN_UNIX_8.6_SONONLY</CODE>.</P> <P>So I can find the process name in the events, but I don't know how to verify when a process is not running.</P> <P>Anyone can give me any suggestion?<BR /> Anyone encountered a similar problem?<BR /> thank you.<BR /> Giuseppe</P> Fri, 30 Oct 2015 13:28:22 GMT gcusello 2015-10-30T13:28:22Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-and-alert-on-processes-that-are-not-running-on-a/m-p/209867#M61372 <P>I have to identify processes not running on a list of hosts.<BR /> To do this, I have a lookup table with all the processes for every host and I have a script that extract ps from linux servers.<BR /> I'm able to find hosts with no running processes using the following search:</P> <PRE><CODE>| inputlookup Processes.csv |eval host=upper(host)| search host="*"| eval count=0 | append [search index=services host=*| search [| inputlookup Processes.csv | search host="*" | eval query=Process | table host query] |eval host=upper(host)| stats count by host ] | stats sum(count) AS Total by host </CODE></PRE> <P>But the problem is that I need to verify both <STRONG>host</STRONG> <EM>and</EM> <STRONG>process</STRONG> names (not only <STRONG>host</STRONG> like the previous search).<BR /> I tried to use two fields (<STRONG>host</STRONG> and <STRONG>Process</STRONG>) in the <CODE>stats count</CODE> (instead of only <STRONG>host</STRONG>) but the problem is that the <STRONG>process</STRONG> names (values) are different between lookup and events. For example, in the lookup, I have <CODE>mailman</CODE> and in ps result I have <CODE>arm_32000_--_2002_OPCMASTER_MAILMAN_UNIX_8.6_SONONLY</CODE>.</P> <P>So I can find the process name in the events, but I don't know how to verify when a process is not running.</P> <P>Anyone can give me any suggestion?<BR /> Anyone encountered a similar problem?<BR /> thank you.<BR /> Giuseppe</P> Fri, 30 Oct 2015 13:28:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-and-alert-on-processes-that-are-not-running-on-a/m-p/209867#M61372 gcusello 2015-10-30T13:28:22Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-and-alert-on-processes-that-are-not-running-on-a/m-p/209868#M61373 <P>Modify your <CODE>ps</CODE> command to provide output formatted more to your liking. The <CODE>man pages</CODE> on <CODE>ps</CODE> document an incredible array of formatting options.</P> Fri, 30 Oct 2015 15:23:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-and-alert-on-processes-that-are-not-running-on-a/m-p/209868#M61373 woodcock 2015-10-30T15:23:18Z