Smart group based on process name?

ant89
Contributor

Is there a way to create a smart group based on a process name? We have carbon black installed. Some clients are not working. need to make a group based on the processname: CbOsxSensorService

I know we can create a policy that checks for processes, but how would i make this into a smart group?

7 REPLIES 7

mpermann
Valued Contributor II

@acorn you could probably make an extension attribute (EA) that will look for the process and report out the existence of the process. But keep in mind that extension attributes are only run at an inventory update. So the frequency of the may determine whether or not an EA would work for you or not.

hkabik
Valued Contributor

You could do it with an Extension Attribute, something like:

#!/bin/bash

# check for process
PROCESS=$( pgrep CbOsxSensorService )

#see if process is running
if [[ -z "$PROCESS" ]]; then
        RESULT="Not Running"
    else
        RESULT="Running"
fi

#report results
echo "<result>${RESULT}</result>"

Then tie the smart group to that EA with a response of Running.

ant89
Contributor

Excellent ill try this out now. Thanks

ant89
Contributor

That worked perfectly thanks @hkabik

bpavlov
Honored Contributor

I'm curious what are you looking to do assuming you do find the process running on the computer? I suspect that if you need to take an action then the EA will be inadequate for what you're trying to achieve. If you need some sort of reporting that most definitely won't be up to date then the EA might work.

ant89
Contributor

Some of our installs got borked, some machines are not running CB correctly so we need to install again on the ones that are not.

phredman
New Contributor III

What if we wanted to get deeper and get the version number of CarbonBlack? cb29e28b8b344a1dbf2a95f8baf7ccb3