Geneos - RHEL 7+ and The Processes Plug-in Isn't Finding My Process

     With RHEL 7, many important upgrades have been introduced. Among these, one of the most notable is the new service launcher named systemd. What was formally known as /sbin/init, has now been replaced with a symlink to /usr/lib/systemd/systemd (reference: https://access.redhat.com/articles/754933) which now launches daemon processes and services.

     Due to the way the OS now handles launching of services during the boot sequence, you must keep in mind that the owner of new forked processes is no longer going to belong to init. Knowing this can save you some time in troubleshooting.

     Suppose you're trying to keep track of your SSH daemon/service launched at startup and only the main service, not any subsequent SSH connections to that server. The reason being that, if someone kills the service, SSH connectivity to that host will be unavailable, rendering all users being unable to initiate new connections. Although, current connections will be unaffected. However, you could see where not being able to initiate a connection could be a problem. Enter the Processes Plug-In. 

     We can accomplish this by setting it up as follows:

Below you will find the XML, so you can use it to your heart's content:

<sampler name="SSH Daemon Monitoring">
<plugin>
<processes>
<processes>
<process>
<data>
<alias>
<data>SSH Daemon</data>
</alias>
<ID>
<searchString>
<data>sshd +-D</data>
</searchString>
<rules>basic/regex</rules>
</ID>
<parentID>
<searchString>
<data>init</data>
</searchString>
<rules>basic/regex</rules>
</parentID>
</data>
</process>
</processes>
</processes>
</plugin>
</sampler>

As you can see, the sampler has been able to find one process launched by systemd. 

Additionally, if you wanted, you could modify the Process parameters section of the Advanced tab for your plug-in, and add the PPID (parent process ID). However, one must note that by doing so, you will have to manually add any other columns of interest. I've included this configuration below, as well as an additional screenshot of the PPID column showing up and a couple of other columns that are of interest to me (should you desire, you can continue adding parameters in the configuration):

As you can see in the above screenshot, the parentProcessId column is showing a PPID of "1", which is the system launcher, in this case systemd. 

<sampler name="SSH Daemon Monitoring">
<plugin>
<processes>
<processParameters>
<data>
<parameter>ppid</parameter>
<parameter>pid</parameter>
<parameter>pmem</parameter>
<parameter>pcpu</parameter>
</data>
</processParameters>
<processes>
<process>
<data>
<alias>
<data>SSH Daemon</data>
</alias>
<ID>
<searchString>
<data>sshd +-D</data>
</searchString>
<rules>basic/regex</rules>
</ID>
<parentID>
<searchString>
<data>systemd</data>
</searchString>
<rules>basic/regex</rules>
</parentID>
</data>
</process>
</processes>
</processes>
</plugin>
</sampler>

     In closing, you now have the ability to monitor any process initiated by your systemd launcher. We hope that you enjoyed this self-help article and please let us know if you have any questions by contacting our Support team.