Monitoring a predefinite number of the same process running on a system

Body

I think most of you already dealt with scenarios where you had to control the availability
of a specific process and create a situation that fires if that process stops running.
This is done using the "Missing" function in the situation editor.

To help with processes having command line length exceeding 768 characters, in Unix and Linux OS agent you also
have Process Filter attribute, that enable in using Regular expressions to filter in processes at data collection time,
so that you can get only the processes of interest for the situation, and execute the Missing function only on them.

This is clearly explained on many technotes and dwanswer entries like:

/support/pages/node/198309  
   
/support/pages/node/162731  
   
https://developer.ibm.com/answers/questions/371577/monitoring-for-missing-processes/

and in many other articles, so we are not going to discuss about it any further.

It can happen you need instead to take under control the exact number of process instances running on the system.

Let's suppose you want to be sure that the number of Java processes running on the system is always 3, because this is the number of application servers
that are expected to run there.
If there are less than 3, it means that one of the production servers is down, if there are 4 or more, it means the orchestrator started unwanted processes
or another product started an unauthorized Java process on the system.
This is why you want to monitor the number of Java processes are 3 and only 3.

If you look at the available attributes into Process attribute group, you will notice one attribute called "Process Count" (Linux) / Count of Processes (Unix).

It returns the count of processes with the same name, so you might thing you could create a situation like:

( SCAN(Command Line) == 'java' AND Process Count != 3)

But actually this will not work.

For Process Count, the name of the process is selected by using the Command Line attribute, that usually in Java processes is most of the time unique, because of differences in
the options used to run the JVM.
Even if you use SCAN function to identify the java string into the Command Line, the Process Count take in consideration the whole Command Line string.
It will result in a data collection having Process Count = 1 for each one of the three monitored Java processes, so the final result would be different than the expected one.

We can use Process Count only if the Command Line value is exactly the same for all the process instances.

So let's forget about Process Count (or Count of processes in Unix) in this specific context scenario. It will not help us.

You can obtain what you are looking for by using instead the function "Count of Group members", that counts the number of returned rows.

A possible solution would be a formula like:

(  SCAN(Command Line) == 'java' AND COUNT(Process Command Name) != '3')

With the SCAN function we select only the rows that includes string "java", and then we use COUNT function on one of the available attributes (it does not matter which one, you can choose anyone) 

to know how many rows matched the previous function.

In this way the situation will fire exactly when the number of java processes running on the server will be different than 3.

Hope it helps

Subscribe and follow us for all the latest information directly on your social feeds: