Simple discovery

Simple discovery is an easy technique that allows end-users to set up monitoring of simple application classes. Both application instance creation and destruction are managed internally by the PATROL product. However, simple discovery does not provide the functionality necessary to set up robust application detection. PATROL supports this discovery method for backward compatibility.

How simple discovery works

Some application instances can be discovered using simple pattern matching to identify the files and processes associated with the application class. This discovery method, called simple discovery, can be used to discover very simple applications and processes running on a computer. Discovery rules can be defined to look for the following items:

Specific file or files
Specific process or processes
A combination of a specific file or specific files and/or a specific process or specific processes
Patterns to match with one or more files and/or with one or more processes or with both

A simple discovery process always uses the internal process cache table data for process detection. When an application instance is discovered using simple discovery, the application instance's operating status is set automatically by the PATROL Agent.

How application instance state is set in simple discovery

The following table summarizes the application instance states that result when the PATROL Agent performs simple discovery. To represent the state of an application instance accurately, the PATROL Agent references the previous state of the application instance.

Simple discovery application instance states

Process	Files	Current application state	Resulting application state
All	All	Any state	OK
All	Some	Any state	WARNING
All	None	Any state	WARNING
All	None defined	Any state	OK
Some	All	Any state	ALARM
Some	None	Any state	ALARM
Some	None defined	Any state	ALARM
None	All	VOID	OFFLINE
None	All	ALARM	Special case
None	All	OFFLINE	OFFLINE
None	All	Any state	ALARM
None	Some	VOID	ALARM
None	Some	OFFLINE	OFFLINE
None	Some	Any state	ALARM
None	None	ALARM	VOID
None	None	Any state	ALARM
None	None defined	ALARM	VOID
None	None defined	Any state	ALARM
None defined	All	Any state	OK
None defined	Some	Any state	WARNING
None defines	None	ALARM	VOID
None defines	None	any state	ALARM
Special case denotes the following possible situations: If the number of application instances is greater than one, the resulting application state is VOID. If there is only one application instance, the resulting application state is OFFLINE

For example, if no process patterns are discovered but some file patterns are, the application instance changes state to an ALARM state. During the next application discovery cycle, if there has been no change in the patterns discovered and only one application instance is detected, the application instance changes state from ALARM to OFFLINE. The PATROL Agent assumes the application instance has shut down because no active processes are detected for it and its previous detected state was an ALARM.
Application instances can also change state as a result of the propagation of parameter alarms and warnings.

Using simple discovery

This section describes the types of application classes that can be detected with simple discovery.

No-process application class

An application class with no processes and one or more files is called a no-process application class. A no-process application class instance is discovered solely on the basis of a list of necessary files--for example, a filesystem. When a no-process application instance is discovered, the PATROL Agent creates the application instance and then executes, as scheduled, any parameters defined for the application class.

Single-process application class

An application class with one process and one or more files is called a single-process application class. When a single-process application instance is discovered, the PATROL Console displays an icon for the application instance and generates and maintains the process ID and other information about the application instance.

Multi-process application class

An application class consisting of several processes and a number of files is called a multi-process application class. When a multi-process application instance is discovered, the PATROL Console displays a single icon representing the application instance. For example, an electronic mail system could have the following processes: mail_unix, and mail_postman.
If all the processes are discovered, the application instance icon is displayed in the OK state. If some processes are not discovered and/or if some of the required files are missing, the Warning or Alarm state application icons are displayed.

Simple discovery programming capsule

Typical simple discovery programming issues are discussed in this topic.

Defining simple discovery rules

Use the following table to select the appropriate simple discovery rule to use to detect a specific type of application class.

Simple discovery rules

Application class type	To set up the discovery rule
Application class type	Use simple file discovery	Use process simple discovery
no-process	Type in a specific file name or names or provide the file name patterns to be matched in the text box.	--
single-process	Type in a specific file name or names and/or provide patterns to be matched to find all required files in the text box.	Type in the process name in the text box.
multi-process	Type in a specific file name or names and/or provide patterns to be matched to find all required files in the text box.	Type in a specific process name or names and/or provide patterns to be matched to find all required processes in the text box.

Using patterns for process or file name matching

Instead of typing an exact process or file name to be matched in the appropriate property tab, you can enter a Portable Operating System Interface (POSIX) regular expression. For example, you could search for all rdb shadow processes with the pattern, ^rdb.*. This search finds all the entries in the process list that start with rdb followed by any character string.

Prototype simple discovery list

The following example illustrates a prototype of a simple discovery process list. Using the following process list, the PATROL Agent performs simple discovery and instantiates an application instance when the eudora.exe process first appears in its internal process cache table.

# The process eudora.exe must exist!

eudora.exe