Monitoring processes

[Scott Allison]

I'm looking for the best way to monitor for processes that are no longer running. 

For instance, COMPUTER1 should have a process called ABCPROCESS.exe. If ABCPROCESS.exe is not running for the last 5 minutes, create an alert. 

What would be the best way to query for this? Can I simply use a process Perf counter and check to see that the process is generating data?

Any help is appreciated. 

[#2]

Hi Scott,

We can not query processes using perf as perf is used for CPU, Memory and Disk.

What you can do is since every service when starts or stops on server will trigger a specific event ID. You can capture that event ID and create a alert as per your requirement.

However its not SCOM so we need write query where we could see event ID along with service name to avoid discrepancy. 

You can check below link and mimic the same to fullfil your need.

https://cloudadministrator.net/2018/01/24/monitoring-windows-services-sates-with-log-analytics/ 

[#3]

Hi Scott,

you can monitor processes under the Performance log. You need to add the Process(*)% Processor Time counter, I have a post on it here. 

https://www.systemcenterautomation.com/2018/07/adding-azure-log-analytics-performance-counters/

Before you do that consider that it will add extra log ingestion and thus billing. That will work, especially if your process isn't installed as a windows service as the blog Gourav linked to. If you use that counter you could then look for when that process is using 0 amount of processor time.

You could also write a powershell script to collect this information for only select processes and send it to the log analytics api.

as always with log analytics there are multiple options to solve a problem.

I hope this helps, 

~Billy