Highlighted
Fleet Admiral Fleet Admiral
Fleet Admiral
1445 views

Service / Process Monitoring strange behaviour

HI Experts,

 

I am facing a starange behaviour from Service / Process Monitoring. On a crtical business server i am monitoring around 30 processes. most of the process has more than 1 instance running of the process.

 

But i get a message saying o process is running.

 

I added opcmona.exe and opcle.exe process in the same policy but for these process it reports correct no. of process.

 

Out of 30 process i took 2 process out and created a new policy including opcle.exe and opcmona.exe again for opcle and opcmona it return correct process no. but for other two it says 0. where at the same time i can see 9 instance are running for those 2 process.

 

Has anyone encountered with such issue or a similar one?

 

Any help will be appriciated.

 

Thank You.

-KAKA-

0 Likes
12 Replies
Highlighted
Vice Admiral
Vice Admiral

Process monitoring is implemented via perl - you can export the policy and check the data to see what is done:

 

 $OVOSystem->ProcessDetails

 

One thing to check is the capitalization though.  It does matter even on windows. Take output of tasklist command as  reference.

Highlighted
Absent Member.. Absent Member..
Absent Member..

Agent version? OM version? ...
Assuming OMW 8/9 and agent 8.60 I would try to request the latest opcmona hotfix (8.60.566) from HP. It solved my issue on HP-UX nodes where only 1/3 of running processes were evaluated with the process/service templates.

BTW How about running a trace on the node 😉
Highlighted
Fleet Admiral Fleet Admiral
Fleet Admiral

Maf - Thanks for your time. capitalization is not an issue and thanks for pointing towards perl script. i have cheked that and seems this works fine.

Peter- Thanks for your time as well. your assumtion were are right. this is on OM 8.16 with agent 8.60. Now i have found out the issue and solution as well but still not clear.

I ran the trace (attaching just catch part). so from here i see that agent has though there are 16 instance listed in the process query for ASRManager.exe but at the end it says found 0 times where for opcmsgi it says found 1 time.

 

So in further look i see there are parameters with each instance of process ASRManager.exe so confiuring the parameter with the process will solve the issue.

 

Now what is not clear is that i can not see these parameters in task manager, i see that OVO does a WMI query to get the details of process, so i ran the WMI query for class Win32_Process on the troubled node (attached is the result) but these parameters are not visible So this is something configure the monitoring and upon receiving the false alarm will get to know that there are some hidden parameters.

 

Any thoughts?

 

KAKA

0 Likes
Highlighted
Vice Admiral
Vice Admiral

try WMIC PROCESS get Caption,Commandline,Processid

 

0 Likes
Highlighted
Absent Member.. Absent Member..
Absent Member..

Looks like your problem is related to the template configuration. Based on what you posted you have defined process monitoring for ASRManager.exe and you left the parameter field empty. That means for the template to look only for processes running without params. Which basically is reporting your template properly 😉
If you want to monitor any instance of the process regardless of params you have to specify an asterisk (*) in the parameter field of template rule...
0 Likes
Highlighted
Fleet Admiral Fleet Admiral
Fleet Admiral

Peter- Thanks once again. but if a process does not show parameters anywhere than why I need to use <*> in the monitoring template? objective of this monitroing is to check that atleast one instance is always running


Help in OMW no where detail about it.
#########################################################
Define the strings or parameters that you need to match. If you use this option, the parameters you specify are used to identify the running process. Standard HPOM pattern matching is used to evaluate the contents of this box, which for Windows managed nodes are not case sensitive. Note that:

If the Parameters box is empty, the policy editor matches only processes running without parameters.

If the Parameters box contains a string with no pattern-matching characters, the policy editor matches only processes with the defined string.

If the Parameters box contains pattern-matching characters, the policy editor matches all process parameters with the string defined (for example, <*> matches all parameters, and <*>abc<*> matches all parameters containing the string "abc").
#########################################################

Do you mean that if I use number of processes field that it is must to have paramters configured and if no parameter than <*>?

KAKA
0 Likes
Highlighted
Absent Member.. Absent Member..
Absent Member..

well it is there:
If the Parameters box is empty, the policy editor matches only processes running without parameters.

So if agent knows about params they have to exist somewhere (ms just does not display them) - run wbemtest, connect to the cimv2 namespace and enumerate all instances of win32_process - I would say there you'll see all the params you are looking for
0 Likes
Highlighted
Vice Admiral
Vice Admiral

seconding that.

 

wmic shows the full startup command line.

0 Likes
Highlighted
Fleet Admiral Fleet Admiral
Fleet Admiral

Peter, i ran the wbemtest and result are same as select * from win32_process and result is attached. you can see property Command Line is Empty for this process.
0 Likes
Highlighted
Fleet Admiral Fleet Admiral
Fleet Admiral

Maf - i am not able to run this command on troubled machine. it gives this error. This is a Windows 2003 Machine.

ERROR
Code = 0x80041017
Description = The request is not valid.
0 Likes
Highlighted
Vice Admiral
Vice Admiral

works for me on:

OS Name:                   Microsoft(R) Windows(R) Server 2003, Enterprise Edition
OS Version:                5.2.3790 Service Pack 2 Build 3790

 

make sure you're typing it right. The error code is a syntax error problem.

 

wmic process get *

lists all info on all procs

 

wmic process get garbage

 

show your error code

 

 

 

 

 

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.