monitoring several processes

[smekla]

Hello,

Tried to look for an answer to my question, but could not found so i'd be happy if anybody would point me to the solution.
I'd like to monitor the processes, that are running on a workstation - let's say: I have a list of "allowed" processes, then I check what processes are running on a workstation and compare them to "allowed" list. If there are any processes that are not "allowed" I want to make some action.
So my question is - how would I do the comparing thing? Thanks for any ideas

[nelsonab]

You're going to have to write a script for this. Without thinking about it too much it's going to be somewhat complicated.

Probably the easiest way would be to have a central server ssh to each box and run px -ax and then run that against a "db" of sorts. If there's an error you could then use the zabbix_sender to push the data into zabbix.

You would need to create a special user on each system and create an ssh key with no password.

pseudocode:

generate list of hosts
loop through hosts
ssh processuser@host ps -ax > /tmp/proceslist
check /tmp/processlist for problems
push needed information back to zabbix using zabbix_sender
continue loop if more hosts

[smekla]

Well then, i guess i'll have to say 'hi' to vbs

Thanks for replay

[nelsonab]

Ah, you want to do this on a windows machine? I would suggest you look at Power Shell then. MS is pushing internally for a lot of use of Power Shell.

[smekla]

Sorry for incomplete question. I was talking about windows machines.

But I'm almost there - I wrote the script which compares to lists of processes (started and allowed) and sends mismatched processes to Zabbix server. All that's left is just to dot the i's and cross the t's