logo

NJP

Diving Into Process Classifier Criteria...

Import · Dec 23, 2008 · article

imageYou've probably heard that astronomers have changed Pluto's classification from "planet" to a mere "solar system body". Though this happened a couple years ago, there's still considerable debate about how to classify Pluto. But unless you're a scientist working in astronomy, you don't have any say about it.Discovery lets you completely control how processes get classified. This may not have the romance of classifying a rock twirling around our local star, but at least it's something you can control!

imageOn this subject, a few days ago a customer asked me a very good question: what values are available in the Name field of a process classification criteria, and what exactly do those values contain? You can see what she was talking about in the screenshot at right, which shows a process classifier that I chose from the list I saw when I navigated to Discovery Definition → Process. The field in question is highlighted in orange.

The answer to her question is that it depends — the values are different for each operating system, with minor variations between versions of operating systems. Here's a table with all the details:

Field Value OS Description
pid All The process ID
name Windows The image name of the process (like "crsst.exe")
output Windows The entire command line used to start the process
output Linux, Solaris, AIX The entire result of the ps command (or the equivalent) for the process
parameters Windows The entire command line used to start the process
command All The fully qualified path to the process' executable (like "D:\Program Files\Rocks\MyRock.exe")
user Linux, OS/X The user that started the process (note that the name may be truncated)
name Netware The NLM name

For some operating systems there are actually a few more values, but these are particularly useful for process classification. For example, under OS/X you can also use "vsz", which is the size (in kilobytes) of the process' virtual memory size.

By far the most useful values for process classification are "name" and "command". The latter is especially useful when you need to distinguish between multiple instances of a particualr executable running on the same box. In such a case, you can look for a value in the parameters, which certainly will be different for the different instances...

View original source

https://www.servicenow.com/community/in-other-news/diving-into-process-classifier-criteria/ba-p/2289599