Well, I *said* it was a simple substitution code. Can't get more simple than that, eh? :)
Good catch, thanks. Doug -- Doug Weathers, Network Administrator St. Charles Medical Center >>> [EMAIL PROTECTED] 12/13/2004 6:20:30 PM >>> That looks like straight ASCII decimal encoding .1.3.6.1.4.1.77.1.2.3.1.1.6.84.101.108.110.101.116 .1.3.6.1.4.1.77.1.2.3.1.1.6.T.e.l.n.e.t -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Doug Weathers Sent: Monday, December 13, 2004 5:08 PM To: [EMAIL PROTECTED] Subject: Re: [IM-Talk] Windows service monitoring I use SNMP to monitor the services on Windows machines. Look through the MIB for "hrSWRunName". Look up the app name and get the index number. Then append it to the OID for hrSWRunName and use that as a Basic OID monitor, or make a custom probe for it. For example, if the application name is "klondike.exe", you'd look through the hrSWRunName table until you found the string "klondike.exe". It will have an index number associated with it, say 1659. Now you monitor the OID 1.3.6.1.2.1.25.4.2.1.2.1659 with a Basic OID probe. You should get a reply of "klondike.exe". If the application isn't running, you'll get a [no such name] error. This is pretty crude and has several flaws, such as the problem that when an application is terminated and restarted it gets a new ID number. There may be a way to do this with the MS LanMgr-Mib-II mib (enterprises 77). There's a table that seems to use an encoding of the service name as an index, so it never changes. I haven't taken the time to figure this one out, but it looks like this: .1.3.6.1.4.1.77.1.2.3.1.1.6.84.101.108.110.101.116 has value Telnet That's svSvcName.6.84.101.108.110.101.116. The 6 is probably the number of characters, and the remaining bytes are probably a fairly simple substitucion code for ASCII characters. Once you've figured out the code, you can work it backwards and figure out the string to append to the svSvcOperatingState OID to find out if it's active or not. For example, to check to see if the telnet service is running, query this OID: .1.3.6.1.4.1.77.1.2.3.1.3.6.84.101.108.110.101.116 It will be 1 for active, 2 for continue-pending, 3 for pause-pending, and 4 for paused. I guess if the service isn't running, that OID won't be there at all. This is only good for services, so I'm not using it (I'm interested in applications in my particular probe). Hope this helps, Doug -- Doug Weathers, Network Administrator St. Charles Medical Center >>> [EMAIL PROTECTED] 12/13/2004 3:33:40 PM >>> What have people found to be the best way to monitor windows servers using InterMapper? I have tried host resources but that leaves me without a means of monitoring services. I then tried Big Brother client but I get different results between server 2000 and windows xp clients, the XP client shows the process status and all the cpu and disk info, but the 2000 client only shows the service status. At one time InterMapper for Windows was going to support service monitoring, but that seems to have gone away. ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED] IMPORTANT NOTICE: This communication, including any attachment, contains information that may be confidential or privileged, and is intended solely for the entity or individual to whom it is addressed. If you are not the intended recipient, you should delete this message and are hereby notified that any disclosure, copying, or distribution of this message is strictly prohibited. Nothing in this email, including any attachment, is intended to be a legally binding signature. ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED] ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED] IMPORTANT NOTICE: This communication, including any attachment, contains information that may be confidential or privileged, and is intended solely for the entity or individual to whom it is addressed. If you are not the intended recipient, you should delete this message and are hereby notified that any disclosure, copying, or distribution of this message is strictly prohibited. Nothing in this email, including any attachment, is intended to be a legally binding signature. ____________________________________________________________________ List archives: http://www.mail-archive.com/intermapper-talk%40list.dartware.com/ To unsubscribe: send email to: [EMAIL PROTECTED]
