Custom check definition to monitor .exe file

[Ryax1]

We have recently started using Agent Client Collectors to setup some basic monitoring on some of our servers/computers and so far have only need to utilise the OOB check definitions (to monitor CPU usage etc.). We now have a requirement to monitor whether a specific .exe file is running on one of our computers. I've had a look at the documentation for creating a check definition but I'm struggling to understand how I would do it/if it's possible. Can anyone help by pointing me in the right direction?

Many thanks

Rich

[Riya Verma]

Hi @Ryax1 ,

Hope you are doing great.

To create a custom check definition for monitoring the .exe file, you can follow these steps:

1. navigate to the "Agent Check Definitions" module.
2.  create a new check definition.
3. In the "Script" field, you can write a PowerShell script or a shell script (depending on the operating system) to check if the specific .exe file is running. Here's an example of a PowerShell script:

$processName = "your_exe_file.exe" //replace file name with you file name
$runningProcesses = Get-Process | Select-Object -ExpandProperty Name
$processRunning = $runningProcesses -contains $processName
if ($processRunning) {
    Write-Output "Process $processName is running."
} else {
    Write-Output "Process $processName is not running."
}
​

• Specify the appropriate target for the check definition, which could be a specific computer or a group of computers. You can use the "Computer Selector" field to define the target based on IP address, hostname, or other criteria.
• Configure the frequency and other parameters for the check definition based on your monitoring requirements.
• Save the check definition.

[Ryax1]

Hi Riya,

Thanks for such a detailed and prompt response, I really appreciate your help. I'll give this a try 😊

Rich

[Ryax1]

Hi again Riya,

I don't have a 'script' field on the check definition table. I have "Timeout script" or "Command", I'm assuming your provided powershell script needs to be inputted into the Command field, is that correct?

Thanks

Richard