Threshold based on COUNT of UnixProcess with same name

[maryu]

I currently have a threshold condition with where clause: EXECNAME IN { "is.exe"}

This alerts if there are NO processes with the name is.exe on the Unix servers being monitored.

I want to change the condition to alert if there are less than 10 processes with the name is.exe on the monitored servers. How can I achieve this? 

[DaleJones]

Hello Mary,

Thank you for the question. Thresholds can only look at one record at a time. To look at 10 or more rows at a time will require an Analyst rule or custom solution. The consulting team will need to be contacted via your Account Manager to have this Analyst or custom solution created. 

Thanks, 
Dale Jones

[Leon_Arens_FNNI]

Did you try using the UnixProcessWorkload record and the where clause of

ExecutableName and ProcessCount.

i.e.

EXECNAME = "is.exe" AND PROCCNT < 10

[maryu]

I wasn't aware of the UnixProcessWorkload record, so I will give that a try this morning. Thank you!

[maryu]

Do you know if there are configurations required for a UnixProcessWorkload?