Discussion:
Process monitoring regex help
briffle
2013-09-30 21:41:43 UTC
Permalink
briffle [http://community.zenoss.org/people/briffle] created the discussion

"Process monitoring regex help"

To view the discussion, visit: http://community.zenoss.org/message/74767#74767

--------------------------------------------------------------
I am trying to monitor some custom processes, and for most, it is very easy.  However, we have some processes where in inittab, we run applications with 'su -c' to force them to run as a different user. In the process list, it looks like this:
root     24263  0.0  0.0  45944  1284 ?        Ss   11:10   0:00 su - user1 -c /usr/local/bin/customAPP /home/user1/config.cfg 
user1  24264  0.0  0.0  12904  1564 ?        Ss   11:10   0:01  \_ /usr/local/bin/customAPP /home/user1/config.cfg


When I use the process modelling to search for "customAPP" it finds both lines, and reports the same process twice. How can I use a regex to exclude the line containing the "su -" command?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74767#74767]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
dhopp
2013-10-03 10:55:56 UTC
Permalink
dhopp [http://community.zenoss.org/people/dhopp] created the discussion

"Re: Process monitoring regex help"

To view the discussion, visit: http://community.zenoss.org/message/74823#74823

--------------------------------------------------------------
Without seeing how your regex is defined, you probably need to set the "Ignore parameters" flag to true on the process definition.  In your first process the /usr/local/bin/customAPP... is a parameter to the command 'su'.  In the second process it's the actual process.

--Dennis
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74823#74823]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
Loading...