ZABBIX Forums  

Go Back   ZABBIX Forums > Zabbix Discussions and Feedback > Zabbix Help

Reply
 
Thread Tools Display Modes
  #1  
Old 14-05-2009, 20:11
gmorey2 gmorey2 is offline
Junior Member
 
Join Date: Apr 2009
Posts: 13
Default Monitoring a process on a Windows 2003 server

Can someone point me to the doc or provide the steps to monitor a Windows process using Zabbix?
Reply With Quote
  #2  
Old 14-05-2009, 23:37
tchjts1 tchjts1 is offline
Administrator
 
Join Date: May 2008
Location: California
Posts: 1,571
Default

One of the easiest ways is to use a perfcounter. Pop a DOS box on your 2003 machine and run typeperf -qx > perflist.txt

That will give you a text file that you can go through for the syntax to use within Zabbix. Best way to go through the textfile is with an editor that will give you the return of all finds on a keyword into a separate window. (such as Notepad++ or probably Uedit)

In any case, do a keyword search on "process". There will be many. Find the process you want to monitor. Then in Zabbix, create an item and use that syntax as the key.

That list will look something like this:

\Process(Idle)\% Processor Time
\Process(System)\% Processor Time
\Process(smss)\% Processor Time
\Process(csrss)\% Processor Time
\Process(winlogon)\% Processor Time
\Process(services)\% Processor Time
\Process(lsass)\% Processor Time
\Process(svchost)\% Processor Time
\Process(svchost#1)\% Processor Time
\Process(svchost#2)\% Processor Time
\Process(svchost#3)\% Processor Time
\Process(svchost#4)\% Processor Time

You'll probably have 2,000+ lines of "\Process", and it depends on exactly what you want to monitor about that particular process.

An example - we want to see how the process tmw2k is consuming CPU including user time, priveleged time, page faults. We also want to monitor IO read/write bytes. Out of those 2,000+ lines we would select the appropiate syntax (or keys) :

\Process(Tmw2k)\% User Time
\Process(Tmw2k)\% Privileged Time
\Process(Tmw2k)\Page Faults/sec
\Process(Tmw2k)\IO Read Bytes/sec
\Process(Tmw2k)\IO Write Bytes/sec

This post will give you an idea on how to enter those into Zabbix:
http://www.zabbix.com/forum/showthread.php?t=12342

If you are using the Windows template to monitor this machine and want this metric to apply to other windows machines, I would create the item(s) at the Windows template level.

Final point to note is that these perfcounters are unique to each machine. While some are probably standard across the W2K3 platform, not all are. They vary according to OS level, service pack, applications installed, what is running, etc. So you would want to run the typeperf command on each machine you want to monitor and double check the syntax.

Last edited by tchjts1; 15-05-2009 at 00:03.
Reply With Quote
  #3  
Old 15-05-2009, 16:56
gmorey2 gmorey2 is offline
Junior Member
 
Join Date: Apr 2009
Posts: 13
Default Monitoring a process on a Windows 2003 server

Tchjts1,

Thank you for your detailed reply to my post. I will attempt the process you outlined this morning. The attribute I want to monitor is more in line with whether the service/process is active or inactive. I'm going through the output gatherned by piping the typeperf command to a file and it is a great deal of information, more then I expected.

George...
Reply With Quote
  #4  
Old 15-05-2009, 17:23
gmorey2 gmorey2 is offline
Junior Member
 
Join Date: Apr 2009
Posts: 13
Default Monitoring a process on a Windows 2003 server

Tchjts1,

I just waded through the things that could be monitored for a process and it's an impressive amount of stuff:

Processor time
User time
Privileged time
Virtual bytes peak
Virtual bytes
Page faults/sec
Working set peak
Working set
Page file bytes peak
Private bytes
Thread count
Priority base
Elapsed time
ID process
Creating process ID
Pool paged bytes
Pool nonpaged bytes
Handle count
IO Read operations/sec
IO write operations/sec
IP data operations/sec
IO other operations/sec
IO read operations/sec
IO read bytes/sec
IO write bytes/sec
IO data bytes/sec
IO other bytes/sec

I imagine I could determine through some of the above attributes whether the process is operational, but I'm not sure this is the best way. Some of these process attributes may come in handy as I become more adept with Zabbix (right now I'm anything but adept) but for the moment my mission is to track the availability of critical processes.

George...
Reply With Quote
  #5  
Old 18-05-2009, 07:09
tchjts1 tchjts1 is offline
Administrator
 
Join Date: May 2008
Location: California
Posts: 1,571
Default

You could probably do an item and key very similar to what is set up for monitoring processes such as Apache, SSH, Zabbix Server, etc.

If I were you, I would simply clone the item for Apache, associated with your windows template. Then I would just modify the key (and description) and change the "apache" portion to whatever the process is you want to monitor.

Make sure that whatever the process name you use is listed in the output of the typeperf list you created.

Below is the screenshot of the item for monitoring the number of Apache processes. You get to that by going to Configuration --> Items and select your windows template from the dropdowns. Once there and you have the below window up, at the bottom, click on "clone". That will give you an editable window. Change the description and the key as appropriate. All you should need to do for the key is change the "httpd" value inside the brackets to the correct name of the process you want to monitor, then save the item.

Once you save it, at the next screen at the very bottom right, click on "mass update". That will update any hosts you have that template assigned to.

From there, you have some monitoring options. You could add a trigger so that if the process is not running, it will show that on the dashboard. To do that, go to Configuration --> Triggers and under the Windows Template again, click on "Apache is not running on template windows" and click on "clone" and change "Apache" in the name field to whatever your process is, then change the Expression field - change "httpd" to your process name. Assign it whatever severity you want.

A second option is to create a graph for it. There will be a default graph under Monitoring --> Latest data, but you could also generate one by going to Configuration --> graphs. Then you could create a screen with that graph, or a group of graphs for that host, or a group of graphs for that process on all hosts.

Have fun
Attached Images
 

Last edited by tchjts1; 18-05-2009 at 17:39.
Reply With Quote
  #6  
Old 20-05-2009, 16:46
gmorey2 gmorey2 is offline
Junior Member
 
Join Date: Apr 2009
Posts: 13
Default Monitoring a process on a Windows 2003 server

I'm back on it after an interlude of other stuff. I'm attempting to follow your directions but am having issues. I log in with admin I click on 'Configuration' selection 'Items' which results in an 'Item Filter' window plus there is an 'History' are with the following:

Host Profiles (local node)
Hosts(name of a window server node I added)
Configuration of items(name of window server node I added)
Hosts(local node)
Configuration of items(local node)

In addition there is a 'Configuration of items' area with a 'Create Item' button.

I click on 'Select' in the 'Item Filter' window and a 'Hosts (local node)' window appears with a list of templates one of them being 'Template_Windows'. I click on the Template_Windows' and 'Template_Windows' populates in the 'from Host like' input area of the 'Item Filter' window. Well I pretty much don't know what the hell I'm trying to do and how I'm to get there. Please excuse my inability to proceed but I guess i need more explicit help.
Reply With Quote
  #7  
Old 20-05-2009, 18:48
tchjts1 tchjts1 is offline
Administrator
 
Join Date: May 2008
Location: California
Posts: 1,571
Default

Quote:
Originally Posted by gmorey2 View Post
I log in with admin I click on 'Configuration' selection 'Items' which results in an 'Item Filter' window plus there is an 'History' are with the following:
You are making it more complicated than it needs to be. Stay way from the "filters" button. When you go to Configuration --> Items, over to the top right is dropdowns for "Group" and "host". Put "Group" to all and for the host, select template windows.

Now scroll down through the description column and click on "Number of running processes apache". from there, follow my previous guideline for cloning that item.
Reply With Quote
  #8  
Old 20-05-2009, 23:03
gmorey2 gmorey2 is offline
Junior Member
 
Join Date: Apr 2009
Posts: 13
Default Monitoring a process on a Windows 2003 server

Okay I've done what you indicated. Cloned and created then saved a configuration item then created a trigger. If I stop the process on a server with the agent what should I see?
Reply With Quote
  #9  
Old 20-05-2009, 23:11
tchjts1 tchjts1 is offline
Administrator
 
Join Date: May 2008
Location: California
Posts: 1,571
Default

Well, provided that the trigger is accurate, on your dashboard you should see a red indicator under the severity column similar to what I show below. You can then hover your mouse over that red number and a pop-up will tell you what the issue is.

Depending on what you have set for the "update interval" for that item, I think by default Apache is set to every 60 seconds and the clone process would carry that over, then it may take up to 60 seconds for the alert to trip.

BTW, if it doesn't work, you might want to share your trigger syntax on here... unless it's super-duper secret.
Attached Images
 
Reply With Quote
  #10  
Old 20-05-2009, 23:31
gmorey2 gmorey2 is offline
Junior Member
 
Join Date: Apr 2009
Posts: 13
Default Monitoring a process on a Windows 2003 server

My dashboard is cursory at best. I've one host group 'Zabbix servers'. Clearly I've not done the groundwork properly.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 22:12.