I've been struggling with a similar problem, but trying to differentiate between Solaris global zones and non-global zones. I want to check for a proc existing on the global zones, but don't want to require that proc in the non-global zones. <div>
<br></div><div>It appears, from my testing, that the CLASS rule directive and tag are not honored for the PROC test. </div><div><br></div><div>I am going to be testing the applicability of the PAGE directive next. I don't really want to have to least each of the hosts I want the PROC test on and can't use the built in OS class (e.g. sunos or linux) because not all hosts of a give OS class have the process running. </div>
<div><br></div><div>If anyone else has solved this problem there are at least 3 of us who would like to know. </div><div><br></div><div>Thanks,</div><div>Steve Holmes</div><div>Purdue University<br><br><div class="gmail_quote">
On Tue, May 3, 2011 at 5:44 PM, Soporte Infraestructura Operativa y Almacenamiento <span dir="ltr"><<a href="mailto:soopal@ice.go.cr">soopal@ice.go.cr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Besides pertinent comments from a few ones (when I have asked about advice/BP on hobbit-clients.cfg) ... Anybody have a clue about why procs tests show all procs from windows/unixses boxes instead the specific ones....<br>
<br>
---parts of hobbit-clients.cfg<br>
CLASS=win32<br>
LOAD 78 98 # Load threholds are in %<br>
TIME=*:0635:1825 #alarmas rojas/amarillas en este intervalo (8x5)<br>
SVC uvnc_service status=started #UltranVNC encendido<br>
SVC TermService status=started #TS encendido<br>
PROC winvnc.exe 1 25 # Al menos un proceso de Ultravnc<br>
PROC BBWin.exe 1 1 # Solo 1 proceso de monitoreo<br>
PORT STATE=LISTENING MIN=0 TRACK=Listen TEXT=Listen<br>
LOG eventlog:System %error.* COLOR=clear #No nos interesan los logs<br>
LOG eventlog:Security %failure.* COLOR=clear #No nos interesan los logs<br>
LOG eventlog:Application %warning.* COLOR=clear #No nos interesan los logs<br>
LOG %.* %error -.* COLOR=clear #No nos interesan los logs<br>
#DOWNTIME=*:1830:0630 #puede apagarse en ese rango (8x5) debe ir en bb-hosts<br>
<br>
HOST=hssftp01 (no specs added since the class have all what I need)<br>
<br>
CLASS=SZCSolSFTP<br>
UP 45m<br>
TIME=*:0000:2400 #alarmas rojas/amarillas en este intervalo 8x5+/24x7<br>
PROC sshd 1 -1 yellow<br>
PROC in.ftpd 1 30 red<br>
PROC cron 1 -1 yellow<br>
PORT "LOCAL=%([.:]21)$" state=LISTEN TEXT=ftp<br>
MEMSWAP 25 55<br>
MEMPHYS 99 101<br>
MEMACT 90 98<br>
LOAD 8 10<br>
CLOCK 95<br>
#DOWNTIME=*:1205:1210 #puede apagarse en ese rango (8x5+/24x7) debe ir en bb-hosts<br>
<br>
DEFAULT<br>
# These are the built-in defaults.<br>
UP 1h<br>
LOAD 8.0 10.0<br>
DISK * 97 99<br>
MEMPHYS 100 101<br>
MEMSWAP 50 80<br>
MEMACT 90 95<br>
<br>
<br>
----parts of bb-hosts file<br>
10.xxx.xxx.xxx hssftp01.hss.dnm.icetel.ice # COMMENT:"FTP Server 01" CLIENT:hssftp01 CLASS:SZCSolSFTP testip prefer multihomed ssh files ports uptime vmstat ftp procs TRENDS:*,ifstat<br>
<br>
<br>
------Error that I received with procs test enable. (and it’s a unix box)<br>
red Mon May 2 13:43:32 CST 2011 - Processes NOT ok<br>
<br>
sshd (found 3, req. 1 or more)<br>
ntpd (found 1, req. 1 or more)<br>
httpd (found 12, req. 1 or more)<br>
cron (found 1, req. 1 or more)<br>
cron (found 1, req. 1 or more)<br>
%hobbitd (found 26, req. between 1 and 1)<br>
winvnc.exe (found 0, req. between 1 and 25)<br>
oracle.exe (found 0, req. between 1 and 1)<br>
BBWin.exe (found 0, req. between 1 and 1)<br>
winvnc.exe (found 0, req. between 1 and 25)<br>
NBConsole.exe (found 0, req. between 1 and 1)<br>
BBWin.exe (found 0, req. between 1 and 1)<br>
%^nb*.exe (found 0, req. 1 or more)<br>
sshd (found 3, req. 1 or more)<br>
named (found 1, req. 1 or more)<br>
cron (found 1, req. 1 or more)<br>
winvnc.exe (found 0, req. between 1 and 25)<br>
VisualSVNServer.exe (found 0, req. between 1 and 10)<br>
BBWin.exe (found 0, req. between 1 and 1)<br>
tnslsnr (found 0, req. 1 or more)<br>
sshd (found 3, req. 1 or more)<br>
ntpd (found 1, req. 1 or more)<br>
%ora_.* (found 0, req. 1 or more)<br>
winvnc.exe (found 0, req. between 1 and 25)<br>
sqlservr.exe (found 0, req. between 1 and 10)<br>
BBWin.exe (found 0, req. between 1 and 1)<br>
sshd (found 3, req. 1 or more)<br>
%java -jar /opt/dai/dai.jar (found 0, req. between 1 and 1)<br>
%java -classpath .:./Frontal* (found 0, req. 1 or more)<br>
winvnc.exe (found 0, req. between 1 and 25)<br>
BBWin.exe (found 0, req. between 1 and 1)<br>
winvnc.exe (found 0, req. between 1 and 25)<br>
BBWin.exe (found 0, req. between 1 and 1)<br>
sshd (found 3, req. 1 or more)<br>
in.ftpd (found 0, req. between 1 and 30)<br>
cron (found 1, req. 1 or more)<br>
sshd (found 3, req. 1 or more)<br>
ntpd (found 1, req. 1 or more)<br>
sshd (found 3, req. 1 or more)<br>
ntpd (found 1, req. 1 or more)<br>
sshd (found 3, req. 1 or more)<br>
ntpd (found 1, req. 1 or more)<br>
tnslsnr (found 0, req. 1 or more)<br>
sshd (found 3, req. 1 or more)<br>
ntpd (found 1, req. 1 or more)<br>
%ora_.* (found 0, req. 1 or more)<br>
<br>
<br>
Thanks a lot!<br>
<br>
Este mensaje de correo electrónico, incluidos los archivos adjuntos, es para el uso exclusivo de la persona a la que se ha enviado, y puede contener información que sea confidencial o protegida legalmente. Si usted no es el destinatario, o ha recibido este mensaje por error, no está autorizado a copiar, distribuir, o utilizar de alguna manera este mensaje. Por favor notifique inmediatamente al remitente por correo electrónico y suprimir permanentemente este mensaje y los archivos adjuntos. No se otorga ninguna garantía de que este e-mail esté libre de errores o virus.<br>
INSTITUTO COSTARRICENSE DE ELECTRICIDAD<br>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
</blockquote></div><br><br clear="all"><br>-- <br><span style="border-collapse:collapse;color:rgb(34, 34, 34);font-family:arial, sans-serif;font-size:13px">The strongest natures, when they are influenced, submit the most unreservedly; it is perhaps a sign of their strength. -Virginia Woolf, writer (1882-1941) </span><br>
<br>Truth never damages a cause that is just. -Mohandas Karamchand Gandhi (1869-1948) <br>
</div>