bosun.org@v0.0.0-20210513094433-e25bc3e69a1f/docs/scollector/process-monitoring.md (about)

     1  ---
     2  layout: default
     3  title: Process Monitoring
     4  ---
     5     
     6  
     7  ## Monitoring Processes with Scollector
     8  
     9  ### Overview
    10  
    11  Scollector can be used to monitor processes and services in Windows and Linux. Some processes like IIS application pools are monitored automatically, but usually you need to specify which processes and services you want to monitor. By having a standard list of processes that are monitored on all systems as part of the default Windows or Linux toml file you won't need to perform any additional configuration when deploying new systems.
    12  
    13  There are examples of process monitoring on the Stack Overflow Documentation topic for [Scollector Process and Service monitoring](http://stackoverflow.com/documentation/bosun/721/scollector-process-and-service-monitoring). 
    14  
    15  ### Linux
    16  
    17  Scollector will monitor any Linux processes specified in the configuration file.
    18  
    19  {% highlight cfg %}
    20  [[Process]]
    21    Command = "/opt/bosun/bosun"
    22    Name = "bosun"
    23  
    24  [[Process]]
    25    Command = "ruby"
    26    Name = "puppet-agent"
    27    Args = "puppet"
    28  
    29  [[Process]]
    30    Command = "/haproxy$"
    31    Name = "haproxy-t1"
    32    Args = "/etc/haproxy-t1/haproxy-t1.cfg"
    33  
    34  [[Process]]
    35    Command = '/usr/bin/redis-server \*:16389'
    36    Name = "redis-bosun-dev"
    37    IncludeCount = true
    38  {% endhighlight %}
    39  
    40  **Command** is a partial text match (older versions) or regular expression (as of 0.5.0-rc1) against the full path of all executing programs. You can use just the executable or include part of the path like "/bin/java". This will not match against arguments except when the cmdline is rewritten by the program (See below).
    41  
    42  **Name** is the value that will be used in the name tag of the `linux.proc.*` and `os.proc.*` metrics that are created. If Name is not specified then a sanitized version of the command text will be used as the name tag value.
    43  
    44  **Args** is a optional regular expression (case sensitive by default) used to select a specific instance of a program. If multiple processes match the given Command and Args they will be assigned incrementing id tag values starting at 1.
    45  
    46  **IncludeCount** is a optional boolean (default is false) to enable the `linux.proc.count` metric as a count of matched processes on each system. This can be used to create alerts when count = 0 or count > 1.
    47  
    48  When setting up process monitoring you can use `ps -ef` to see a list of running processes and their arguments. Some processes change the command stored in /proc/_pid_/cmdline to be more user friendly, but scollector is looking for NUL delimited arguments so this can cause issues. For instance, to monitor a redis process you must look at the raw value of the cmdline and set the Command to match since the arguments are delimited by 0x20 spaces instead of 0x00 NUL bytes:
    49  
    50  {% highlight text %}
    51  cat /proc/80156/cmdline | hexdump -C
    52  00000000  2f 75 73 72 2f 62 69 6e  2f 72 65 64 69 73 2d 73  |/usr/bin/redis-s|
    53  00000010  65 72 76 65 72 20 2a 3a  36 33 37 39 00 00 00 00  |erver *:6379....|
    54  00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    55  00000030  00                                                |.|
    56  00000031
    57  
    58  #Example for cmdline without NUL (00) delimiters between args (using \ to escape * in regex)
    59  [[Process]]
    60    Command = 'redis-server \*:6379'
    61    Name = "redis-core"
    62  {% endhighlight %}
    63  
    64  ### Systemd Services
    65  
    66  Scollector uses the D-Bus API to determine the state of services managed by systemd and specified in the configuration file.
    67  
    68  {% highlight text %}
    69  [[SystemdService]]
    70    Name = "^(puppet|redis-.*|keepalived|haproxy-t.*)$"
    71    WatchProc = false
    72  
    73  [[SystemdService]]
    74    Name = "^(scollector|memcached)$"
    75    WatchProc = true
    76  {% endhighlight %}
    77  
    78  **Name** is a regular expression that matches against the service unit names. If the Name matches then it will be monitored under the `linux.systemd.unit.*` and `os.service.*` metrics.
    79  
    80  **WatchProc** is an optional boolean (default is false) to specify if the primary process for the service should be included as a monitored linux process under `linux.proc.*` and `os.proc.*`. This may not work for processes that fork, use init scripts, or launch multiple sub processes.
    81  
    82     
    83  
    84  ### Windows
    85  
    86  Scollector will monitor any Windows processes or services specified in the configuration file.
    87  
    88  {% highlight cfg %}
    89  [[Process]]
    90    Name = "^scollector"
    91  
    92  [[Process]]
    93    Name = "^chrome"
    94  
    95  [[Process]]
    96    Name = "^(MSSQLSERVER|SQLSERVERAGENT)$"
    97  {% endhighlight %}
    98  
    99  **Name** is a regular expression (case sensitive by default) that matches against the Name property of the service or process WMI classes. Use `gwmi Win32_Service` and `gwmi Win32_Process` in PowerShell to see a list of possible values. If the Name matches a Win32_Service name then that process will be monitored under the `win.service.*` and `os.service.*` metrics. If the name matches a process or a service (with ProcessId != 0) that process will be monitored under the `win.proc.*` and `os.proc.*` metrics. If there is more than one matching process they will be assigned incrementing id tag values starting at 1.
   100  
   101  Note: IIS worker pool processes are automatically monitored using iis_pool-name as the name tag value. These will also have additional metrics under `iis.*`
   102  
   103  ### .NET Processes
   104  
   105  Scollector can also monitor any Windows processes using the .NET framework. If no ProcessDotNet settings are specified it will default to just monitoring the w3wp worker processes for IIS. You can specify which applications to monitor in the configuration file.
   106  
   107  {% highlight cfg %}
   108  [[ProcessDotNet]]
   109    Name = "^w3wp"
   110  
   111  [[ProcessDotNet]]
   112    Name = "LINQPad"
   113  {% endhighlight %}
   114  
   115  **Name** is a regular expression (case sensitive by default) that matches against the Name property of the [.NET Performance counters](https://msdn.microsoft.com/en-us/library/w8f5kw2e.aspx). Matching process will be monitored under the `dotnet.*` metrics, and if there is more than one matching process they will be assigned incrementing id tag values starting at 1. Where possible the w3wp names will be changed to match the iis_pool-names used for process monitoring.