Getting Data In

Windows Process

itsomana
Path Finder

On a Windows 2003 there is a process running in windows called java.exe. Do you know of a way that Splunk can monitor that java.exe and alert if it is not running.

My approach is to write a script/bat file which runs tasklist. This would be scheduled to run every 5 minutes and would pipe the information out to a file. This file would then be indexed by Splunk. Within Splunk I could search this file and if java.exe is found send out an alert me.

For reference the server is running a Splunk forwarder

Thanks in advance.

Tags (2)

Takajian
Builder

I think your approach is right. But your script/bat files is not necessary to write file for splunk indexing. As splunk can do scripted input, splunk can execute and index the result of the script without tasklist.

Please refer to following site for more infomation.

http://docs.splunk.com/Documentation/Splunk/latest/Developer/ScriptedInputsIntro

0 Karma

saurabh_tek
Communicator

Is there any other way as well @Takajian. or else can you share the script

0 Karma

rvany
Communicator

For reference - the link has (some years later 😉 ) - changed:
http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...