Alerting

How do you set up an alert for when an application process is not running or hung?

bsaujla131984
Path Finder

There are a number of application processes in our environment which either go down or stop responding. I am trying to setup an alert in the event if process is down or hung in Unix/Linux.

Can anyone assist with this please?

0 Karma

ddrillic
Ultra Champion

It's interesting in the context of Splunk processes which can be hung, forwarders or indexers...

0 Karma

bsaujla131984
Path Finder

This is not related to Splunk process. It is related to application process in Linux/Unix servers.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @bsaujla131984 - Did @inventsekar 's answer below help provide a solution to your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

bsaujla131984
Path Finder

Hi @mstjohn... I would need more info. The answer is given is mainly related to commands, however I would like to do it through Splunk...

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Gotcha, thanks bud! Good luck with your issue.

0 Karma

inventsekar
Ultra Champion

from a linux forum... "ps auxww |grep 'process_ID' " you can have current process' status like S (Sleep), R (Running) , Z (zombie) etc..

[root@server]# cat /proc/2324/status
Name: kmpathd/1
State: S (sleeping)
SleepAVG: 98%
Tgid: 2324
Pid: 2324
PPid: 13
TracerPid: 0
Uid: 0 0 0 0
Gid: 0 0 0 0
FDSize: 32

Also, by using top command, you can see if the running process is taking high cpu(probably, hung process)

then you can create an alert accordingly..

0 Karma

bsaujla131984
Path Finder

Actually I want something which can be done entirely through Splunk instead of logging to UNIX/Linux serves..

0 Karma

jkat54
SplunkTrust
SplunkTrust

Do you have a way of knowing if the process is hung?

ie: curl to see if port is open, or run service $name status

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...