C.10. Checking for hidden/fake/required processes

Section heading:

[ProcessCheck]

Entries:

ProcessCheckActive=boolean — 'true' to switch on, 'false' to switch off.

SeverityProcessCheck=severity — Severity for events (default is crit).

ProcessCheckMinPID=integer — Minimum PID (default is 0).

ProcessCheckMaxPID=integer — Maximum PID (default is 32767).

ProcessCheckInterval=seconds — Interval between checks.

ProcessCheckExists=POSIX regular expression — A process that is required to run. Must match a substring in a line of the 'ps' output.

ProcessCheckPSPath=path — The path to ps (default: autodetected at compile time).

ProcessCheckPSArg=path — The argument to ps (default: autodetected at compile time). Note that the first column must be the PID, except on Linux, where the format 'PID SPID ...' is expected (spid = thread id), as shown by 'ps -eT'.