| Windows Rule Syntax for Service Monitoring Events |
|
Rule Format: alert_level;service_regex;min;max;comment_or_description;regen_boolean
|
| Field |
Example Values |
Notes |
| alert_level |
red | yellow |
The level of alert that will be generated if this process falls
outside of specified parameters. |
| service_regex |
Fax Service
|
The string or simple regular expression that will match the Windows
service you wish to monitor. If you wish to make sure that the matching service
is NOT running, simply put a "!" in front of the process_regex. |
| min |
1 |
Not used on Windows - defaults to 1
|
| max |
0 |
Not used on Windows - defaults to 0 |
| comment_or_description |
|
Optional comment or description that will appear if this alert is triggered. |
| regen_boolean (optional) |
true | false |
This is the boolean flag that tells the Sensor whether you want
to restart the Service if it is found to not be running. However in order for
this service to be restarted, an identical copy of the "service_regex"
for this rule MUST be in the "regen.cmds" file in the "conf"
directory on the Sensor in which this command will be executed. This is for your
safety, as commands have the potential to be run as a privileged user. |
| Unix | Win32 |
|