I have to identify processes not running on a list of hosts.
To do this, I have a lookup table with all the processes for every host and I have a script that extract ps from linux servers.
I'm able to find hosts with no running processes using the following search:
| inputlookup Processes.csv |eval host=upper(host)| search host="*"| eval count=0 | append [search index=services host=*| search [| inputlookup Processes.csv | search host="*" | eval query=Process | table host query] |eval host=upper(host)| stats count by host ] | stats sum(count) AS Total by host
But the problem is that I need to verify both host and process names (not only host like the previous search).
I tried to use two fields (host and Process) in the stats count (instead of only host) but the problem is that the process names (values) are different between lookup and events. For example, in the lookup, I have mailman and in ps result I have arm_32000_--_2002_OPCMASTER_MAILMAN_UNIX_8.6_SONONLY.
So I can find the process name in the events, but I don't know how to verify when a process is not running.
Anyone can give me any suggestion?
Anyone encountered a similar problem?
thank you.
Giuseppe
