|
From: | cgzones |
Subject: | Process ppid checking |
Date: | Tue, 22 Nov 2016 23:30:38 +0100 |
Hi list,
i'd like to ask about two ideas for improving ppid checking.
First idea is about checking the ppid against a pre defined value, mostly 1, like:
check process matching myprocess
if changed PPID then alert
if PPID != 1 then alert
The second idea deals with coupled process, where one process should be the parent of the other one, e.g.:
check process matching myprocess-parent
if PPID != 1 then alert
check process matching myprocess-child
if PPID != myprocess-parent then alert
Are there any chances that this might come with a future version?
Kindly Regards,
Christian Göttsche
[Prev in Thread] | Current Thread | [Next in Thread] |