Alerting
Highlighted

How to create an alert if process is not running in linux?

New Member

Hi -

I need to create an alert where if a process is not running in a linux server , then it should send out an alert :

Below query is giving me correct results of all the processess running in a server:

index="index-name" source=ps host="hostname*" process="*process_name*" 
| dedup host process
| join host [search index="index-name" source=ps host="hostname*" process="*process_name*" 
| stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen]
|eval status=if(lastSeen<(_time - 300), "not running","running") 
|table host status process

Example Output :

Host : hostname
Status : running
process : process_name

But I need to send an alert if the status is not running.

Could anybody help me with it?

Labels (1)
0 Karma
Highlighted

Re: How to create an alert if process is not running in linux?

SplunkTrust
SplunkTrust

Use this search and have the alert trigger when the number of results is zero.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to create an alert if process is not running in linux?

Communicator

Save it as an alert. That should do the trick for you, whenever your alert detects if a service isn't running.

index="index-name" source=ps host="hostname*" process="process_name"
| dedup host process
| join host [search index="index-name" source=ps host="hostname*" process="process_name"
| stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen]
|eval status=if(lastSeen<(_time - 300), "not running","running")
|table host status process
| search status = "not running"

If it doesn't help, you can save the specific condition status = "not running" in aler settings -> Trigger Conditions -> Trigger alert when and from the drop down, select custom and define the condition there.

Hope this helps,

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.