Need to trigger an alert when a process is not running

[ajromero]

Need to trigger an alert when a process is not running, here is my query but I can not the alert to work index="os" source="Perfmon:Process" host="vm* process_name="RT*" | dedup host process | join host [search index="os" source=Perfmon:Process host="vm*" process_name="RT*" | stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen] |eval status=if(lastSeen<(_time - 300), "not running","running") |table host status process_name | search status = "not running" or is there another way to look for windows process not running thank you

[bowesmana · Accepted solution]

Your search is a little odd - there is no need to join the first search with the second as they are searching the same data

index="os" source="Perfmon:Process" host="vm*" process_name="RT*" 
| stats latest(_time) as lastSeen by host process_name
| where lastSeen>=relative_time(now(), "-300s")
| eval status="not running"
| table host status process_name 

Does that work for you? Are you looking to get the latest HOST time or process_name time?

It's splits by process_name, but you may then get different times for each process. If you want to find if it's the HOST that's not running, then you could add

| eventstats max(lastSeen) as lastSeenHost by host

and change the where clause to use lastSeenHost in the test.

However, if your host does not report ANY data in your search time window, you can only know that it's not running if you know the name of all hosts that _SHOULD_ be running, which you would do by populating a lookup with all expected hosts and then using that list to validate whether the host is present or not