Monitoring a process with OpsMgr

We had a multiple environments where we needed to know if a process (not a service) was running on a system. If you want to be alerted when a service is unavailable, this can be done by using the Windows Service Management Pack Template (Authoring -> Management Pack Templates -> Windows Service). Or it can be done through creating a custom monitor for the service. (For details on that you can read the upcoming Microsoft Systems Center Operations Manager 2007 Unleashed book – yes, that was a shameless self-serving book plug, but it is really covered well there J ).

This is common for functions like batch processes which often run logged in to a console as a specific user and launched via a shortcut on the desktop. I created a custom management pack which provides alerts when a process is not running an acceptable number of process name you specify. The Process Monitor provides alerting if a process specified is not running within an acceptable range. IE: Is MyBigCustomerApp.exe is not running at least once on this server create a critical alert. If MyBigCustomerApp.exe is running too many times send a warning alert.

The management pack is available for download at: http://systemcenterforum.org/wp-content/uploads/ProcessMonitor.zip

PLEASE NOTE: This monitor disabled by default and is designed to be disabled. If you enable the monitor with the default configuration it will alert on every server because either too many or too few svchost.exe’s are running on the system so don’t enable the monitor.

The functionality in this monitor is activated on a per-server basis through overrides, and the acceptable number of processes and the name are specified on the parameters for the monitor.

To activate this on a server, create the override for the System Center Managed Computer (Any OS) version of the ProcessMonitor. This override needs to enable the server and needs to specify the parameters for the process to monitor. As an example:

Enable the override – set the Enabled parameter to True

Specify the parameters - the name of the exe and then a space and the lower acceptable value and upper acceptable value.

Example: For Server1 we enable the override parameter to True, and specify the parameters to svcmon.exe 1 2.

This says for the Server1 system to activate this rule, and alert if there is less than 1 svcmon.exe running on the system or if there are greater than 2 svcmon.exe running on the system.

Finally, within the script which is run as part of this monitor there are a variety of lines which are commented. These are used to create events in the event log to assist with script debugging. So if you activate this with an override for a server and want to see what steps are occurring with the script you can make this occur through uncommenting the lines such as:

'     Set objShell = Wscript.CreateObject("Wscript.Shell")

'     objShell.LogEvent EVENT_TYPE_SUCCESS, _

'     "ProcessMonitor run with " & strProcess & " " & GoodLowerCount & " " & GoodUpperCount & " as arguments."

within the script. This monitor can also be enhanced by creating a diagnostic and/or a recovery. This could be used as an example to restart a process which is not running or to stop a process which is running too many times on a system.