Smart group based on process name?

[ant89]

Is there a way to create a smart group based on a process name? We have carbon black installed. Some clients are not working. need to make a group based on the processname: CbOsxSensorService

I know we can create a policy that checks for processes, but how would i make this into a smart group?

[mpermann]

@acorn you could probably make an extension attribute (EA) that will look for the process and report out the existence of the process. But keep in mind that extension attributes are only run at an inventory update. So the frequency of the may determine whether or not an EA would work for you or not.

[hkabik]

You could do it with an Extension Attribute, something like:

#!/bin/bash

# check for process
PROCESS=$( pgrep CbOsxSensorService )

#see if process is running
if [[ -z "$PROCESS" ]]; then
        RESULT="Not Running"
    else
        RESULT="Running"
fi

#report results
echo "<result>${RESULT}</result>"

Then tie the smart group to that EA with a response of Running.

[ant89]

Excellent ill try this out now. Thanks

[ant89]

That worked perfectly thanks @hkabik

[bpavlov]

I'm curious what are you looking to do assuming you do find the process running on the computer? I suspect that if you need to take an action then the EA will be inadequate for what you're trying to achieve. If you need some sort of reporting that most definitely won't be up to date then the EA might work.

[ant89]

Some of our installs got borked, some machines are not running CB correctly so we need to install again on the ones that are not.

[phredman]

What if we wanted to get deeper and get the version number of CarbonBlack?