Create alert for a new server process

[ryanaud]

I'm trying to find a way to create an alert if a new process has been started.
My old solution would learn the processes running on my servers for 15 days, then if a new process was started after the 15 days it would alert me to let me know. Then after that it wouldn't alert me again unless there was a 15-day gap.

For example, if I launch Google Chrome on a server every 16 days, I would get an alert letting me know the process was started.

[gcusello]

Hi,
You have to create a lookup (e.g. Processes.csv).
Schedule a search to populate lookup:
Your_search earliest=-15d latest= now
| dedup processes
| table process
| outputlookup Processes.csv
In this way you have a list of all processes in last 15 days.
After you can run you search
Your_search NOT [| inputlookup Processes.csv | fields process]
And use it For an alert.
To extract processes you have to create a script with ps command.
Bye.
Giuseppe