Alerting

How to create an alert if process is not running in linux?

stotta11
New Member

Hi -

I need to create an alert where if a process is not running in a linux server , then it should send out an alert :

Below query is giving me correct results of all the processess running in a server:

index="index-name" source=ps host="hostname*" process="*process_name*" 
| dedup host process
| join host [search index="index-name" source=ps host="hostname*" process="*process_name*" 
| stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen]
|eval status=if(lastSeen<(_time - 300), "not running","running") 
|table host status process

Example Output :

Host : hostname
Status : running
process : process_name

But I need to send an alert if the status is not running.

Could anybody help me with it?

Labels (1)
0 Karma

shivanshu1593
Builder

Save it as an alert. That should do the trick for you, whenever your alert detects if a service isn't running.

index="index-name" source=ps host="hostname*" process="process_name"
| dedup host process
| join host [search index="index-name" source=ps host="hostname*" process="process_name"
| stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen]
|eval status=if(lastSeen<(_time - 300), "not running","running")
|table host status process
| search status = "not running"

If it doesn't help, you can save the specific condition status = "not running" in aler settings -> Trigger Conditions -> Trigger alert when and from the drop down, select custom and define the condition there.

Hope this helps,

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use this search and have the alert trigger when the number of results is zero.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...