How can I trigger alert when there are too many instances of the same process?
Q: How can I send an email alert if the number of explorer.exe processes is greater than 5 on a target server?
A: If you use IPHost Network Monitor of version 4.0.9306 or newer you can use a specific WMI Process monitor to count running processes with the specified name. Add and configure the WMI Process monitor as shown on the image below:
The monitor returns a number of running ‘explorer.exe’ processes. You can set Value Bounds state condition on the monitor State conditions tab, so that the monitor switches to Down state if the returned number is larger than it should be.
Either, for any version of IPHost Network Monitor, you can use the following sample script with Script or Program monitor:
On Error Resume Next
Set count = 0
Set strComputer = "."
Set strExe = "explorer.exe"
Set objWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" &
strcomputer & "\root\cimv2")
Set colProcessList = objWMI.ExecQuery ("SELECT * FROM Win32_Process WHERE Name = '" &
strExe & "'")
For Each objProcess in colProcessList
Set count = count + 1
Next
WScript.echo count
WScript.Quit(0)
Specify target compute name (leave “.” if local computer). Save the above script under any suitable name (.vbs filename extension is recommended), place it on the computer running IPHost Network Monitor and create Script or Program monitor using the script above. Specify “Script” type of monitor.
Also, for any version of IPHost Network Monitor, you can create a simple WMI monitor with the following parameters:
Both the script and WMI query return string containing integer number. It can be directly used on State Conditions tab, just specify intervals to trigger alerts properly on Main parameters tab.
To do that, open State Conditions tab, add Value Bounds section to either Down or Warning sections (or both) and set the value to comparison, for example, switch to Warning state if the script returns 6 and greater, and 3 or less.
