Splunk Search

Can you help me monitor httpd process through Splunk on a Linux Machine?

ssatti
New Member

Greetings all,

I want to monitor an "httpd" process for a Linux Machine, and if the process is down or not running, I need to shoot an alert.

Could you please help me with the search query for this?

Thanks in advance.

0 Karma

lakshman239
Influencer

You can install nix add on and enable the process monitoring scripted input. This gives you all active processed, including 'httpd'. on the server. You can then create a seach/alert when the process 'httpd' is down (not seen in the events coming from the add-on).

https://splunkbase.splunk.com/app/833/

0 Karma

lakshman239
Influencer

Did this help you resolve the issue?

0 Karma

ssatti
New Member

I already had Nix addon and enabled the process monitoring.
But Search/alert is not working as expected. could you please give me an example search. Thanks Lakshman

0 Karma

renjith_nair
Legend

@ssatti,
It would be helpful if you could provide some more details.
- Have you tried something ?
- Do you have the events about status already in splunk ? If not you have to start from pushing the status to splunk.
- If you have the events, how do they look like ? Any sample events?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...