Process Monitoring with NetCrunch WMI Sensors.

Learn how to configure a node-specific WMI Object sensor to monitor a specific Windows process and generate an event when the process is restarted. This sensor-based monitoring strategy leverages the uniqueness of PID, against the generic name of a process.

WMI Object sensor

The WMI Object sensor is located in the Monitoring Sensors section of a device node settings: Node Settings > Monitoring Sensors > WMI > WMI Object Sensor.

1. Select WMI Object from the WMI Sensor portfolio of sensors.
2. Provide the Object ID - this will be the name/description of the sensor and will give you the ability to distinguish among multiple sensors on the same node. The name should be meaningful.
3. Use the following sensor selections:
   1. Namespace: root\CIMV2
   2. WMI_Class: Win32_Process
   3. Instance Key: Name
   4. Instance: Your monitoring target. (SE note: Name is not unique to the process. Use this sensor to monitor a single instance process by name)
4. Validate your sensor results by using the test icon, located at the top right corner of the WMI Object Window.

Creating Alerts

For a single instance process, the easiest way to check whether a process was started/restarted is to watch PID (Process Identifier) of the process. Steps below will guide you how to set an alert based on PID.

1. Open sensor and click on + add alert
2. Select new event for Status Object Change
3. Use the following Alert settings
   • ObjectId: ProcessId
   • When Previous State was:
     • State: Unknown
     • Condition: Not Equals
   • and the State changes to:
     • State: Unknown
     • Condition: Not Equals
4. Set name of the alert i.e "CRM Process Was Started/Restarted"

This logic detects PID change and it will raise an alert when PID change will be detected. Please note that the first PID that will be read will not raise an alert.

Reversing this logic provides notification that a process has been terminated, and can be configured as the following Alert

1. Add new event for Status Object Change

2. Use the following Alert settings

   • ObjectID: ProcessId

   • When the Previous State was:

     • State: Any

   • and the State changes to:

     • State: Unknown
     • Condition: Equals

3. Set name of the alert i.e. "CRM Process is not working" and set severity to Critical

This alert will be triggered when a named process loses its PID. This event will be auto-closed when the process is started.

This feature requires NetCrunch version 10.1+

monitoringprocesswindowswmi process