Unix Rule Syntax for Process Monitoring Events
Rule Format: alert_level;process_regex;min;max;comment_or_description;regen_cmd;regen_user
Field Example Values Notes
alert_level red | yellow The level of alert that will be generated if this process falls outside of specified parameters.
process_regex httpd.*conf
The string or simple regular expression that will match the process you wish to monitor. If you wish to make sure that the matching process is NOT running, simply put a "!" in front of the process_regex.
min 1 The minimum number of processes that should match process_regex. If the actual number falls below the minimum number, the specified alert_level will be generated.
Default is 1.
max 0 The maximum number of processes that should match process_regex. If the actual number goes above the maximum number, the specified alert_level will be generated.
Default is 0 (unlimited).
comment_or_description   Optional comment or description that will appear if this alert is triggered.
regen_cmd (optional)
/usr/sbin/apachectl start The regeneration command is the optional command that should be executed if the number of matching processes fall below the minimum number specified. In order for this command to be executed, an identical command MUST be in the "regen.cmds" file in the "conf" directory on the Sensor in which this command will be executed. This is for your safety, as commands have the potential to be run as root.

Note: this command will be executed as stated, and the Sensor will wait 10 seconds for control to return to the program, if control is not restored, the script will attempt kill the process, therefore this command should either exit quickly, or be followed with a "&" to background the process.
regen_user (optional) nobody The regeneration user is the user that the command specified in "regen_cmd" should be run as.
Unix | Windows