CheckProcState with param

[anonymous]

With CheckProcState i can only check one process "cmd.exe". If more than one cmd.exe is running it should be possible to qualify the correct process on the basis of the paramter (any *.cmd) with cmd.exe was startet.
All process are listet in OID '1.3.6.1.2.1.25.4.2.1' and the corresponding parameter in
'1.3.6.1.2.1.25.4.2.1.5'.
Thanks

[mickem]

Added this in the latest nightly, this has a few breaking changes so keep a look out and let me know if this is what you want:

From change log

 + Added command line support for process checks
   New option: cmdLine will toggle so full command lines are used instead of just process names.
 + Added regular expression matching to process checks
   New option: match=regexp (match=strings is the default and "old" way)
 + Added substring matching to process checks
   New option: match=substr (match=strings is the default and "old" way)
   This is *NOT* case blind so might be hard to use, plan to add case blindness to it in the future.
 : Sample command: check_nt ... -v PROCSTATE -l cmdLine,match=regexp,.*exp.* -d SHOWALL
 * Ohh yeah... it is 2008 this year... not 2007, fixed a few entries in the changelog :)
 - BREAKING CHANGE! -- Removed TOOLHELPER API as PSAPI is simpler and toolhelp is really only useful on w9x (which I dont officially support)

[anonymous]

Options cmdLine and match=regexp works very fine!

Exactly what i need!

Thanks

[anonymous2]

I'm having problems getting a match on processes are I know is running similar to "DRT_java.exe". I've tried the following combinations:

check_nt!PROCSTATE -l match=regexp,*java\.exe -d SHOWALL
check_nt!PROCSTATE -l match=regexp,.*java\.exe -d SHOWALL
check_nt!PROCSTATE -l match=regexp,(.*java\.exe) -d SHOWALL
check_nt!PROCSTATE -l match=regexp,.*java.* -d SHOWALL
check_nt!PROCSTATE -l match=regexp,java -d SHOWALL
check_nt!PROCSTATE -l match=regexp,java.exe -d SHOWALL
check_nt!PROCSTATE -l match=regexp,.*java.exe -d SHOWALL

Is my syntax wrong?

[anonymous]

only supported in the latest nightly (it is a feature scheduled for 0.4.0 not 0.3.1)

MickeM

[anonymous]

It's possible to extend CheckProcState once more?

I want to check two identical processes (v.exe) that differ only in WorkingDir? (OID '1.3.6.1.2.1.25.4.2.1.4') which was started from.

A new option 'workDir" like 'cmdLine'?
Thanks

[mickem]

Closing this as it is implemented