I was able to get this to work. What version of BSA are you using? Can you attach a screenshot of the Rules you are using?
Thank you Joe for your fast answer.
Our BSA version :
[root@xxx bladelogic]# cat Version
A rule like the following one works ..
but this rule cannot be used globally as the PID varies.
Please advice which "rule" and which "part" should be used.
why do not you use ps command to check if sshd is running ?
otherwise try importing attached script as an EO. IN 8.5 this is by default exist and shall bring all th erunning process info for you. You may create your compliance rule around this.
running_processes.nsh 1.6 K
did you try:
where name = xxx
close ..... the rule seems to be ok now, but it seems the correct "part" is missing in the compliance check template.
Below you see that the check was compliant for server itoclmbppmr1t (the one below the highligthed one on the left). On this server the sshd process PID is 3745. For any other server the check failes when trying to find process 3745 (see red check result on the rigth).
In the parts folder of the compliance check, I was able to create a "Processes.Process" Part only with a distinct PID.
Could you advice how to create a "Processes.Process" with a wildcard PID ?
Then the check should be complete ...
can you post your rule for "check sshd process" ? Are you using the earlier object in this rule w/ a specific PID ?
As shown in my previous reply I am able to add processes as apart to my CT. If you have used the object w/ specific PID in your rule then update your rule as below.
Note: If the error still persists then just edit and reassign the object reference in the rule by browsing New Configuration Object...
You may be correct. Still can you just retry below method once and see how it goes.
remove the part Processes(both w/ specific PID and Processes object) from component template.
remove/comment out rules referring to processes object.
save your component tempalte.
now add only Processes object as demonstrated in my earlier reply.
now create a new rule or uncomment your existing rule.(its better to create a new one,may be becoz of old reference to PID object).
can you set up a webex ? I can jump and may be we can fix it. Let me know I will share my email id.
Its gr8 if you can fix it else hopefully we may fix this tomorrow. Leaving for the day.