The name of the process that you want to monitor. The string you enter here must match the name of the process as it is known to Windows, including the file extension, for example: "notepad.exe". Duplicates are not allowed. The name you enter here is checked against the list of existing processes defined for this policy.
You can monitor multiple instances of a process by using
parameters to differentiate between the instances (for example,
svchost.exe -k rpcss and svchost.exe -k
netsvcs). For more information, see Parameters
below.
Define the strings or parameters that you need to match. If you use this option, the parameters you specify are used to identify the running process. Standard HPOM pattern matching is used to evaluate the contents of this box, which for Windows managed nodes are not case sensitive. Note that:
- If the Parameters box is empty, the policy editor matches only processes running without parameters.
- If the Parameters box contains a string with no pattern-matching characters, the policy editor matches only processes with the defined string.
- If the Parameters box contains pattern-matching characters, the policy editor matches all process parameters with the string defined (for example, <*> matches all parameters, and <*>abc<*> matches all parameters containing the string "abc").
Use the pull-down menu to specify the number of monitored processes. You can specify an exact number with the "equals" operator (==), or use the less-than (<) or more-than (>) operators to define a range (for example, >=1).
NOTE
The value you enter here defines the state which the policy
expects to find and considers correct. The policy sends a
message to the console only if the state it finds is not
the expected one. For example, use >= 1 (greater than or equal
to one) to check that one or more instances of the notepad.exe
process are running. If the policy discovers that 0 (zero)
instances of notepad.exe are running, it sends a message to the
console.
Choose whether you want to use the default actions defined for the process, or specify your own, customized actions:
- Default Actions:
Click Defaults in the Policy dialog box to specify that you want the process monitor to use the default actions defined for the policy.
- Custom Actions:
Click Custom defined if you want to define custom actions for a process monitor. If you check this option, you will have to use the options in the Start actions, Continue actions and End actions tabs to configure the actions that you want to occur when the policy finds a match. The actions tabs you use here are the standard HPOM tabs for defining a message and automatic or operator-initiated action.