Help finding pid file for a service

IRJ

I am setting up monit for doing some monitoring of services.

I have configured it to monitor the two following services using the settings below:

check process auditd with pidfile /var/run/auditd.pid
        start program = "/etc/init.d/auditd start" with timeout 60 seconds
        stop program  = "/etc/init.d/auditd stop"

check process suricata with pidfile /var/run/suricata.pid
        start program = "/etc/init.d/suricata start" with timeout 60 seconds
        stop program  = "/etc/init.d/suricata stop"

I am trying to monitor the wazuh-agent, but I dont see a single pid, there are several. I am assuming I need to monitor all these services. I am unsure how to point monit to the pid file like I did with the other services.

IRJ

Welp found another solution that is working

#***********************************************************
# Monitoring wazuh agent
#***********************************************************

check process wazuh-execd
        matching "ossec-execd"

check process wazuh-agentd
        matching "ossec-agentd"

check process wazuh-syscheckd
        matching "ossec-syscheckd"

check process wazuh-logcollector
        matching "ossec-logcollector"

check process wazuh-modulesd
        matching "wazuh-modulesd"

When i stop, I now get an email

black3dynamite

Can zabbix do the something similar like monit?

IRJ

@black3dynamite said in Help finding pid file for a service:

Can zabbix do the something similar like monit?

It's likely. I'm not familiar with zabbix, but I just decided to try monit and so far I'm liking it.