# Alert when a service stops on linux

**URL:** <https://discuss.elastic.co/t/alert-when-a-service-stops-on-linux/293003>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [December 27, 2021, 10:20pm UTC](https://discuss.elastic.co/t/alert-when-a-service-stops-on-linux/293003 "2021-12-27T22:20:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![derek.olds](https://avatars.discourse-cdn.com/v4/letter/d/958977/32.png) [@derek.olds](https://discuss.elastic.co/u/derek.olds)\
**Post date:** [December 27, 2021, 10:20pm UTC](https://discuss.elastic.co/t/alert-when-a-service-stops-on-linux/293003/1 "2021-12-27T22:20:24Z")

</div>

I can get a list of processes running on a host, but I don't get a signal when the process stops. Do I need to set something up to track number of records over a given time? Is there an easier way?

---

<div class="post-metadata">

**Author:** ![Edoardo\_Tenani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edoardo_tenani/32/94302_2.png) [@Edoardo\_Tenani](https://discuss.elastic.co/u/Edoardo_Tenani)\
**Post date:** [December 28, 2021, 8:49am UTC](https://discuss.elastic.co/t/alert-when-a-service-stops-on-linux/293003/2 "2021-12-28T08:49:48Z")

</div>

Hi @derek.olds ,

I think what you want may be achieved using Osquery, in particular with the [`processes` table](https://osquery.io/schema/5.0.1#processes). Filebeat has an `osquery` [module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-osquery.html) that would allow to collect log results.

You could then use [Kibana Alerting](https://www.elastic.co/what-is/kibana-alerting) to react based on number of running processes.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 28, 2021, 10:11pm UTC](https://discuss.elastic.co/t/alert-when-a-service-stops-on-linux/293003/3 "2021-12-28T22:11:10Z")

</div>

Hi @derek.olds Welcome to the community.

In addition to @Edoardo_Tenani excellent suggestion based on the new OSQuery capabilities. (I need to learn more about this too!)

You could also use [Metricbeat System Module Process metricset](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-process.html) ...

Collect on the processes you are interested in and then use the Kibana Alerting framework with a metric threshold alert.

---

<div class="post-metadata">

**Author:** ![derek.olds](https://avatars.discourse-cdn.com/v4/letter/d/958977/32.png) [@derek.olds](https://discuss.elastic.co/u/derek.olds)\
**Post date:** [January 3, 2022, 5:39pm UTC](https://discuss.elastic.co/t/alert-when-a-service-stops-on-linux/293003/4 "2022-01-03T17:39:33Z")

</div>

Thanks for the responses. I will look into those solutions and see what I come up with.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2022, 7:39pm UTC](https://discuss.elastic.co/t/alert-when-a-service-stops-on-linux/293003/5 "2022-01-31T19:39:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.