Alerting

Create alert for a new server process

ryanaud
New Member

I'm trying to find a way to create an alert if a new process has been started.
My old solution would learn the processes running on my servers for 15 days, then if a new process was started after the 15 days it would alert me to let me know. Then after that it wouldn't alert me again unless there was a 15-day gap.

For example, if I launch Google Chrome on a server every 16 days, I would get an alert letting me know the process was started.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi,
You have to create a lookup (e.g. Processes.csv).
Schedule a search to populate lookup:
Your_search earliest=-15d latest= now
| dedup processes
| table process
| outputlookup Processes.csv
In this way you have a list of all processes in last 15 days.
After you can run you search
Your_search NOT [| inputlookup Processes.csv | fields process]
And use it For an alert.
To extract processes you have to create a script with ps command.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...