Process Probe capabilities

[Siddharth Rai]

Hello All,

we have receive below requirement from our application team for setting up the processes 

we don't want IOPS to set up monitoring to ensure the mentioned processes run at any point in time, but we need alarm to be generated if they run more than an hour whenever they run.


Please suggest how can this be configured .

------------------------------
System Analyst
DXC Technology
------------------------------

[Gene Howard]

Hi we would need to know the OS type and version you are dealing with.
The processes probe currently can not do this.
But there might be another way of using logmon if we have more details.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Siddharth Rai]

Red Hat Enterprise Linux Server release 7.5 (Maipo)

------------------------------
System Analyst
DXC Technology
------------------------------

[Gene Howard]

So you would need to create a script that did the following
1) Check and see if the process is running.
2) if the process is running get the current pid.
3) then determine the length of time it has been running and generate a message accordingly.

Some sample commands:
https://www.cyberciti.biz/faq/how-to-check-how-long-a-process-has-been-running/

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Siddharth Rai]

Thank you Gene.
I will try and update.

------------------------------
System Analyst
DXC Technology
------------------------------

[Siddharth Rai]

Hi Gene,

I am able to get the details from the command but not able to set the watcher/ variable 
can you please help me with setting up variables ? and do we have any article for setting up watcher rules with examples ?

------------------------------
System Analyst
DXC Technology
------------------------------

[Gene Howard]

Below are is a specific use case:
https://docops.ca.com/ca-unified-infrastructure-management-probes/ga/en/alphabetical-probe-articles/logmon-log-monitoring/logmon-use-case-examples#logmonUseCaseExamples-ConfigureCustomVariableinWatcherRule

But on that same page are all of the use cases:

If you do a search for "UIM logmon admin videos" you will find some youtupe videos for use case examples as well.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Yu Ishitani]

FYI
https://ca-broadcom.wolkenservicedesk.com/external/article?articleId=10880

[Siddharth Rai]

Hi Yu, 

Thank you for the update 

Currently i am running below command through logmon

ps -C PROCESS-NAME-o etime 
and the result is
ELAPSED
01:30:50 

so if i want to get an alarm that contains ELAPSED & its time , can you please help me with how to do it ?
and i want to get an alarm when the ELAPSED is anything after 01:00:00 

------------------------------
System Analyst
DXC Technology
------------------------------

[Yu Ishitani]

You need to convert value format to something numeric so that it can be compare-capable, as you can see in the article example, so that operator works.

[Siddharth Rai]

Hi Yu,
I am not sure how to set up the variable in watcher rules.
Would it accept XX:XX:XX format 

You need to convert value format to something numeric so that it can be compare-capable, as you can see in the article example, so that operator works.- having trouble in setting it up. No sure what values to give in variable . please help me with that 

I want the result of the cmd - ELAPSEED 01:30:50 in the alarms text 

------------------------------
System Analyst
DXC Technology
------------------------------

[Yu Ishitani]

To make comparison simple, I suggest you find out how to parse process uptime in numeric format.

[Daniel Enchev]

Hi Sid,

As discussed today, best way to configure this monitoring is as Gene suggested, to have script that is executing the needed commands/parsing. Then configure logmon to capture and display alarms, based on output.

For the rest in topic, what we did today with Sid and UIM environment was to configure logmon profile, that will check output of the above command. 

It basically contains two columns and two lines with STARTED, ELAPSED, time started, time elapsed. 
Using the logmon documentation and use cases there, we configured format rule, watcher rule (match expression *ELAPSED*), and few variables (elapsed - for the ELAPSED text, and var - for time elapsed). Then alarm message is looking like this: $var $ELAPSED.

Further, there could be additional play with exclude/watcher rule that would look in the time string and not generate alarms when it's 00:*:*, and will generate alarm when it's *(?!0):*:* and so on.