Unix Rule Syntax for Process Monitoring Events | ||
---|---|---|
Rule Format: alert_level;process_regex;min;max;comment_or_description;regen_cmd;regen_user | ||
Field | Example Values | Notes |
alert_level | red | yellow | The level of alert that will be generated if this process falls outside of specified parameters. |
process_regex | httpd.*conf |
The string or simple regular expression that will match the process you wish to monitor. If you wish to make sure that the matching process is NOT running, simply put a "!" in front of the process_regex. |
min | 1 | The minimum number of processes that should match process_regex.
If the actual number falls below the minimum number, the specified alert_level
will be generated. Default is 1. |
max | 0 | The maximum number of processes that should match process_regex.
If the actual number goes above the maximum number, the specified alert_level
will be generated. Default is 0 (unlimited). |
comment_or_description | Optional comment or description that will appear if this alert is triggered. | |
regen_cmd (optional) |
/usr/sbin/apachectl start | The regeneration command is the optional command that should be
executed if the number of matching processes fall below the minimum number specified.
In order for this command to be executed, an identical command MUST be in the
"regen.cmds" file in the "conf" directory on the Sensor in
which this command will be executed. This is for your safety, as commands have
the potential to be run as root. Note: this command will be executed as stated, and the Sensor will wait 10 seconds for control to return to the program, if control is not restored, the script will attempt kill the process, therefore this command should either exit quickly, or be followed with a "&" to background the process. |
regen_user (optional) | nobody | The regeneration user is the user that the command specified in "regen_cmd" should be run as. |
Unix | Windows | ||