Anybody in Splunk answers tried to register process to monitor for Unix systems?
I am trying to set-up Splunk to monitor running status of a process. When a process dies, meaning no longer exists, then I want splunk to generate an event that the process no longer is running in a system.
It sounds pretty simple, but my delima is that when I search for a process, for example httpd. When the httpd is running then, it would give me a result to verify that the process is there, but when the process no longer exists, splunk will fail searching for that process event. Based on the result that failed to search a process event, how can I make that situation into an event?
I would appreciate it if anyone has simular monitoring template that mointors certain proceses' status.
Do you know about the Unix App?
If you do some research and have a look at this app you will notice that it grabs process information using the TOP command around every 60 seconds.
Using a search then you can have splunk notify you if this process is not running.
head 1 will retrieve only the latest polling cycle, giving you the "current" status. If you want to do things like charting status over time, leave that bit out. Using 1 or 0 makes charting easier, but you can also replace them with text values like "Running" or "Not Running", etc.