1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
# Processes bodies
body process_select exclude_procs(x)
# @brief Select all processes excluding those matching `x`
# @param x Regular expression matching the command/cmd field
# of the processes that should be excluded
{
command => "$(x)";
process_result => "!command";
}
##
body process_select days_older_than(d)
# @brief Select all processes that are older than `d` days
# @param d Days that processes need to be old to be selected
{
stime_range => irange(ago(0,0,"$(d)",0,0,0),now);
process_result => "!stime";
}
##
body process_select by_owner(u)
# @brief Select processes owned by user `u`
# @param u The name of the user
#
# Matches processes against the given username and the given username's uid
# in case only uid is visible in process list.
{
process_owner => { "$(u)", canonify(getuid("$(u)")) };
process_result => "process_owner";
}
body process_select by_pid(pid)
# @brief Select a process matching the given PID
# @param pid PID of the process to be matched
{
pid => irange("$(pid)","$(pid)");
process_result => "pid";
}
##
body process_count any_count(cl)
# @brief Define class `cl` if the process is running
# @param cl Name of the class to be defined
{
match_range => "0,0";
out_of_range_define => { "$(cl)" };
}
##
body process_count check_range(name,lower,upper)
# @brief Define a class if the number of processes is not
# within the specified range.
# @param name The name part of the class `$(name)_out_of_range`
# @param lower The lower bound of the range
# @param upper The upper bound of the range
{
match_range => irange("$(lower)","$(upper)");
out_of_range_define => { "$(name)_out_of_range" };
}
bundle agent process_kill(name)
# @brief Kill a process by name (can be a regular expression)
# @param name the regular expression or string
#
# **Example:**
#
# ```cf3
# methods:
# "kill" usebundle => process_kill("badprocess");
# ```
{
processes:
!windows::
# Signals are presented as an ordered list to the process.
"$(name)" signals => { "term", "kill" };
windows::
# On Windows, only the kill signal is supported, which terminates the process.
"$(name)" signals => { "kill" };
}
|
