Monitoring Splunk

Monitor That Windows 7 is listening on a specified port

scamarda
New Member

I need to monitor that an application is active on a Windows 7 machine. The application listens on port 80. If the application is up, the Windows machine will show it is listening on port 80. A netstat -ano would be good to show that the application is active. I am using the universal forwarder. Can you give me an idea of what I can use to verify the application is active and listening on port 80?

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could deploy a script to your UF that periodically runs things like the netstat command you mentioned. Splunk will index the output and you can search/alert/report from there. I'm sure you can also get a list of running processes/services as well.

To make sure you don't reinvent the wheel you should check if https://splunkbase.splunk.com/app/1680/ has a similar thing already built.

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...