identify running processes using snmp

> is there any way to identify running processes name

> using snmp and what mib should I use?

The SunMC module you want to load is called "Process Monitoring". The information it tracks is here:

http://docs.sun.com/app/docs/doc/816-2716/6m9214nte?a=view#i1036007

> if yes, is this mib part of the default snmp provided

> by sun or should it be installed in addition to the

> default snmp?

It's part of the standard mib collection shipped with SunMC. Check your SunMC Server for *.mib files in this directory:

/opt/SUNWsymon/util/cfg

If you're looking to get any sort of alarms out of the system or do things like set thresholds and corrective action scripts your best bet is to set it up with the SunMC Console and have the alarms forwarded to you using EventAction (http://www.halcyoninc.com/products/EventAction/index.php).

Regards,

Mike.Kirk@HalcyonInc.com

MikeKirk at 2007-7-6 13:22:25 >

Hi Stephen,

sorry about the delay (short vacation)....

if I understand yout answer correctly

using net-snmp I would stil have to have an account on the remote machine in order to identify the name of the process through the PID.

is that right ? or do you know way to obtain this information using snmp without any account on the remote machine?

adiso75 at 2007-7-6 13:22:25 >

You don't need accounts on the systems you are managing. All you would need is the read-only SNMP community string and a good knowledge of SNMP. As an example, my Solaris 10 system..

# snmpwalk -Os -c public -v 1 localhost hrSWRunName

produces a list of processes. Lets pick a couple as the output can be lengthy.

hrSWRunName.550 = STRING: "nmbd"

hrSWRunName.556 = STRING: "sh"

hrSWRunName.581 = STRING: "mysqld"

If the processes change the PID, you will need to look for them assuming they are running all the time.

What you could do is run the above command and grep for your process. Lets say I am interested in mysqld..

bash-3.00# snmpwalk -Os -c public -v 1 localhost hrSWRunName | grep mysqld

hrSWRunName.581 = STRING: "mysqld"

You can see it is in the output and on a side note, look at the number 581.

bash-3.00# ps -ef | grep 581

mysql5815560 17:10:56 ?0:02 /usr/sfw/sbin/mysqld --basedir=/usr/sfw --datadir=/var/mysql --user=mysql --pid

Its the PID of the process.

If you want more info and are willing to give your system a bit of work to do.. (but not really recommended)

bash-3.00# snmpwalk -Os -c public -v 1 localhost | grep ".581"

hrSWRunIndex.581 = INTEGER: 581

hrSWRunName.581 = STRING: "mysqld"

hrSWRunID.581 = OID: zeroDotZero

hrSWRunPath.581 = STRING: "/usr/sfw/sbin/mysqld"

hrSWRunParameters.581 = STRING: "--basedir=/usr/sfw --datadir=/var/mysql --user=mysql --pid"

hrSWRunParameters.812 = STRING: ".581"

hrSWRunType.581 = INTEGER: application(4)

hrSWRunStatus.581 = INTEGER: runnable(2)

hrSWRunPerfCPU.581 = INTEGER: 190

hrSWRunPerfMem.581 = INTEGER: 14172 KBytes

hrSWInstalledIndex.581 = INTEGER: 581

hrSWInstalledName.581 = STRING: "SUNWmddr"

hrSWInstalledID.581 = OID: zeroDotZero

hrSWInstalledType.581 = INTEGER: operatingSystem(2)

hrSWInstalledDate.581 = STRING: 2005-3-19,11:15:30.0,+11:0

Without holding your hand too much, I am sure you can see where I am going.

localhost can be any system running the snmp daemon. All you need is the read only community string.

Cheers

Stephen

stephen2602 at 2007-7-6 13:22:25 >