# Process monitor **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-monitoring\ **Created:** [January 29, 2024, 5:59pm UTC](https://discuss.elastic.co/t/process-monitor/352026 "2024-01-29T17:59:30Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Gadapa\_Vasundhara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gadapa_vasundhara/32/131201_2.png) [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Post date:** [January 29, 2024, 5:59pm UTC](https://discuss.elastic.co/t/process-monitor/352026/1 "2024-01-29T17:59:30Z")
Hi Team, I need some help on process monitor ex: datamonitor.exe process from logstash which plugin i need to use. wmi plugin is not working. and more over we are getting the status of process.state as running only.whenever if stops how can i monitor from elk. please help on this ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [January 31, 2024, 9:49am UTC](https://discuss.elastic.co/t/process-monitor/352026/2 "2024-01-31T09:49:27Z")
Hi @Gadapa_Vasundhara, Welcome! By WMI plugin, which plugin do you mean? Is there are particular error you are seeing in the logs? ---
**Author:** ![Gadapa\_Vasundhara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gadapa_vasundhara/32/131201_2.png) [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Post date:** [January 31, 2024, 12:13pm UTC](https://discuss.elastic.co/t/process-monitor/352026/3 "2024-01-31T12:13:24Z")
Hi Yes Logstash stopped processing because of an error: (LoadError) load error: win32ole/win32ole -- java.lang.UnsatisfiedLinkError: /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jruby-win32ole-0.8.5/lib/racob-x64.dll: /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jruby-win32ole-0.8.5/lib/racob-x64.dll: invalid ELF header. Am getting this error how to enable process monitor in elk.logstash is stopping automatically if am using wmi plugin ---
**Author:** ![Gadapa\_Vasundhara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gadapa_vasundhara/32/131201_2.png) [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Post date:** [January 31, 2024, 12:14pm UTC](https://discuss.elastic.co/t/process-monitor/352026/4 "2024-01-31T12:14:12Z")
please help me with the solution ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [January 31, 2024, 4:27pm UTC](https://discuss.elastic.co/t/process-monitor/352026/5 "2024-01-31T16:27:31Z")
I believe the WMI plugin only works with Logstash running on Windows see: [Logstash-input-wmi win32ole invalid ELF header · Issue #15 · logstash-plugins/logstash-input-wmi · GitHub](https://github.com/logstash-plugins/logstash-input-wmi/issues/15) ---
**Author:** ![Gadapa\_Vasundhara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gadapa_vasundhara/32/131201_2.png) [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Post date:** [January 31, 2024, 4:41pm UTC](https://discuss.elastic.co/t/process-monitor/352026/6 "2024-01-31T16:41:34Z")
Ok Thanks @strawgate but how can i monitor from linux server for process from elk ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [January 31, 2024, 8:59pm UTC](https://discuss.elastic.co/t/process-monitor/352026/7 "2024-01-31T20:59:28Z")
You could look at deploying elastic agent or one of the beats like metricbeat into the device that has the process running ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [January 31, 2024, 9:25pm UTC](https://discuss.elastic.co/t/process-monitor/352026/8 "2024-01-31T21:25:40Z")
I would say the same, EA or MB, however if you need something specific to monitor you can use a pearl script and run it with the exec input plugin. I'm pretty sure MB will be enough with [the system module](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-system.html). ---
**Author:** ![Gadapa\_Vasundhara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gadapa_vasundhara/32/131201_2.png) [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Post date:** [February 1, 2024, 3:25am UTC](https://discuss.elastic.co/t/process-monitor/352026/9 "2024-02-01T03:25:47Z")
Hi Rios can you send me the pearscript with exec plugin . From elastic agent we enabled the from system integration process but we are facing whenever the process is stopped in server we are not getting any stopped state and showing as running .Kindly help me on this ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [February 1, 2024, 10:22am UTC](https://discuss.elastic.co/t/process-monitor/352026/10 "2024-02-01T10:22:04Z")
I don't have the script, you can write it, or run: `ps aux | grep datamonitor.exe` ---
**Author:** ![Gadapa\_Vasundhara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gadapa_vasundhara/32/131201_2.png) [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Post date:** [February 2, 2024, 3:51pm UTC](https://discuss.elastic.co/t/process-monitor/352026/11 "2024-02-02T15:51:37Z")
ok thanks ---
**Author:** ![Gadapa\_Vasundhara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gadapa_vasundhara/32/131201_2.png) [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Post date:** [February 5, 2024, 9:41am UTC](https://discuss.elastic.co/t/process-monitor/352026/12 "2024-02-05T09:41:13Z")
Can we someone help me one adding condition inside system -\> process integration for to get correct state to monitor process of .exe ---
**Author:** ![Gadapa\_Vasundhara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gadapa_vasundhara/32/131201_2.png) [@Gadapa\_Vasundhara](https://discuss.elastic.co/u/Gadapa_Vasundhara)\ **Post date:** [February 8, 2024, 3:37pm UTC](https://discuss.elastic.co/t/process-monitor/352026/13 "2024-02-08T15:37:37Z")
> [@strawgate](#): > > believe the WMI plugin only works with Logstash running on Windows From linux server how can we enable this process? ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [February 8, 2024, 3:59pm UTC](https://discuss.elastic.co/t/process-monitor/352026/14 "2024-02-08T15:59:25Z")
> [@Gadapa\_Vasundhara](#): > > Can we someone help me one adding condition inside system -\> process integration for to get correct state to monitor process of .exe For Elastic Agent? ![Screenshot 2024-02-08 at 9.58.31 AM](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11532c5f5b352988419b2626d8232fc0419629e9.png) Have you tried including your process in the processes list? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 7, 2024, 4:00pm UTC](https://discuss.elastic.co/t/process-monitor/352026/15 "2024-03-07T16:00:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.