# How to Monitor particular process and file system disk space through metricbeat

**URL:** <https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [October 31, 2017, 3:01pm UTC](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909 "2017-10-31T15:01:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![udareddy](https://avatars.discourse-cdn.com/v4/letter/u/919ad9/32.png) [@udareddy](https://discuss.elastic.co/u/udareddy)\
**Post date:** [October 31, 2017, 3:01pm UTC](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909/1 "2017-10-31T15:01:08Z")

</div>

Hi All,  
I am happy that we have very good forum to discuss and help each other on ELK stack, and am very new to ELK stack integrations but I have good knowledge on Splunk integration.

I am seeking help on below requirement.

1. we want to monitor a particular process (SSA, (# service SSA status) ) and file system disk space (/var/lib/SSA ) through metricbeat, which is running on Linux ( RHEL), so what will be the metricbeat module configuration code we have to use ?

process name is SSA  
file system is /var/lib/SSA

Thanks  
Uday.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 1, 2017, 12:36pm UTC](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909/2 "2017-11-01T12:36:50Z")

</div>

The [system Metricsets](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-system.html#_metricsets_16) has support for [process metrics](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-process.html), [filesystem Metrics per mountpoint](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-filesystem.html), and [diskio Metrics per mountpoint](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-system-diskio.html). Is this what you are looking for?

---

<div class="post-metadata">

**Author:** ![udareddy](https://avatars.discourse-cdn.com/v4/letter/u/919ad9/32.png) [@udareddy](https://discuss.elastic.co/u/udareddy)\
**Post date:** [November 1, 2017, 6:06pm UTC](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909/3 "2017-11-01T18:06:04Z")

</div>

Thanks for your quick reply,  
l have verified above mentioned link but am not able to fine what am looking, my bad ☹  
we want to monitor one of the open tcp listen port i.e 8443 in linux (RHEL) host for every 10s.  
and need to check file system usage /var/lib/ssg for every 10s.

--Uday.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 1, 2017, 7:33pm UTC](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909/4 "2017-11-01T19:33:48Z")

</div>

> [@udareddy](#):
>
> we want to monitor one of the open tcp listen port i.e 8443

You can use the system socket metricset to monitor listening TCP sockets and active connections.

```auto
metricbeat.modules:
- module: system
  metricsets: [socket] 
  period: 500ms

```

And if you want to only report events for port 8443 you can add a filter.

```auto
metricbeat.modules:
- module: system
  metricsets: [socket] 
  period: 500ms
  filters:
  - drop_event.when.not.equal.local.port: 8443

```

> [@udareddy](#):
>
> and need to check file system usage /var/lib/ssg for every 10s

Metricbeat's filesystem metricset monitors mount points. So if you want to get stats specifically for this directory then it needs to be its own mount point. We don't have a metricset that acts like `du` and traverses a directory summing up all the file sizes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 29, 2017, 7:33pm UTC](https://discuss.elastic.co/t/how-to-monitor-particular-process-and-file-system-disk-space-through-metricbeat/105909/5 "2017-11-29T19:33:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.