How to detect there are too many instances of the same process?

How can I trigger alert when there are too many instances of the same process?

Q: How can I send an email alert if the number of explorer.exe processes is greater than 5 on a target server?

A: If you use IPNetwork Monitor of version 4.0.9306 or newer you can use a specific WMI Process monitor to count running processes with the specified name. Add and configure the WMI Process monitor as shown on the image below:

The monitor returns a number of running ‘explorer.exe’ processes. You can set Value Bounds state condition on the monitor State conditions tab, so that the monitor switches to Down state if the returned number is larger than it should be. Either, for any version of IPNetwork Monitor, you can use the following sample script with Script or Program monitor:

On Error Resume Next

Set count = 0
Set strComputer = "."
Set strExe = "explorer.exe"

Set objWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & 
    strcomputer & "\root\cimv2")
Set colProcessList = objWMI.ExecQuery ("SELECT * FROM Win32_Process WHERE Name = '" &
    strExe & "'")
For Each objProcess in colProcessList
   Set count = count + 1
Next

WScript.echo count
WScript.Quit(0)

Specify target compute name (leave “.” if local computer). Save the above script under any suitable name (.vbs filename extension is recommended), place it on the computer running IPNetwork Monitor and create Script or Program monitor using the script above. Specify “Script” type of monitor.

Also, for any version of IPNetwork Monitor, you can create a simple WMI monitor with the following parameters:

Both the script and WMI query return string containing integer number. It can be directly used on State Conditions tab, just specify intervals to trigger alerts properly on Main parameters tab.

To do that, open State Conditions tab, add Value Bounds section to either Down or Warning sections (or both) and set the value to comparison, for example, switch to Warning state if the script returns 6 and greater, and 3 or less.

Related topics