Monitor a process from specific user with Process.CountEx fails

[stoffmann]

Hi,
I have to monitor if a process is running under a specific user in Windows.

I use Process.CountEx for doing that.

In Taskmanager the username is shown like AD001\z004abcd
Processname is EB_BPM.exe

I tried: Process.CountEx("EB_BPM.exe",,"AD001\z004abcd")
and ( in case the Backslash is the problem):  Process.CountEx("EB_BPM.exe",,"(?i)z004abcd")

Both fail.
Using just  Process.CountEx("EB_BPM.exe") works, but I need to have the username.

Using  NetXMS 5.2.1
Any idea?

Stefan

[Filipp Sudanov]

Did you try
Process.CountEx("EB_BPM.exe",,"z004abcd")
?

[stoffmann]

I tried. It's also not working. Always returning 0.

In logfile with Loglevel 7 I find:

2025.06.23 09:08:32.521 *D* [comm.cs.1          ] Requesting metric "Process.CountEx("EB_BPM.exe",,"z004abcd")"
2025.06.23 09:08:32.555 *D* [comm.cs.1          ] GetMetricValue("Process.CountEx("EB_BPM.exe",,"z004abcd")"): 0 (SUCCESS) value = "0"

But the process is running.

[stoffmann]

Do You need more information to solve this? Please let me know.

Regards

Stefan

[victor]

how do you see this process in "Processes" view for that node?

[stoffmann]

In process view the column user is almost empty.

Only BUILTIN\Administrators shows up for some processes.

---

[Filipp Sudanov]

Well, that explains why the metric does not return what you expect. 

How do you run the agent - under SYSTEM user or in some other way?

[stoffmann]

We have the agent running with a domain account, that is member of the Administrators group.

[Filipp Sudanov]

Please try to run the agent under system user to see if that makes any difference

[stoffmann]

Running it as system now shows the usernames in the Process View. But why doesn't it work with an administrative account?

[Filipp Sudanov]

Agent uses GetSecurityInfo win api function, please check information about needed access rights here:
https://learn.microsoft.com/en-us/windows/win32/api/aclapi/nf-aclapi-getsecurityinfo#remarks