How to create an alert if process is not running in linux?

[stotta11]

Hi -

I need to create an alert where if a process is not running in a linux server , then it should send out an alert :

Below query is giving me correct results of all the processess running in a server:

index="index-name" source=ps host="hostname*" process="*process_name*" 
| dedup host process
| join host [search index="index-name" source=ps host="hostname*" process="*process_name*" 
| stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen]
|eval status=if(lastSeen<(_time - 300), "not running","running") 
|table host status process

Example Output :

Host : hostname
Status : running
process : process_name

But I need to send an alert if the status is not running.

Could anybody help me with it?

[richgalloway]

Use this search and have the alert trigger when the number of results is zero.

[shivanshu1593]

Save it as an alert. That should do the trick for you, whenever your alert detects if a service isn't running.

index="index-name" source=ps host="hostname*" process="process_name"
| dedup host process
| join host [search index="index-name" source=ps host="hostname*" process="process_name"
| stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen]
|eval status=if(lastSeen<(_time - 300), "not running","running")
|table host status process
| search status = "not running"

If it doesn't help, you can save the specific condition status = "not running" in aler settings -> Trigger Conditions -> Trigger alert when and from the drop down, select custom and define the condition there.

Hope this helps,