Example: Using the Process Monitor to check for antivirus software

You can use the Process Monitor to verify that antivirus or anti-spyware software is a running on a device. If the monitor does not find the specified program running, an associated action notifies you of this potentially harmful vulnerability.

For this example, you will configure and assign a Process Monitor that checks to see if Norton AntiVirus™ is running on a device. You will also configure and assign an Email Action to notify you if the monitor fails.

To configure the Process Monitor:

In the Active Monitor Library, click New. The Select Active Monitor Type dialog appears.
Select Process Monitor from the list, then click OK. The Add Process Monitor dialog appears.
Enter a Name for the monitor, such as Norton AntiVirus Monitor.
Enter a Description for the monitor. This description is displayed next to the monitor name in the Active Monitor Library.
Type or browse (...) to the Process name that the monitor will check. To monitor Norton AntiVirus software, enter rtvscan.exe.
Under the Thresholds to monitor section of the dialog, select Down if the process is and not loaded. If the monitor does not find the rtvscan.exe process running on the device to which the monitor is assigned, the monitor is considered down.
Tip: Click Advanced to set the SNMP timeout and number of retries, and to decide if the monitor is used in Discovery.
Click OK to save changes.

After configuring the Norton AntiVirus Monitor, you need to assign it to the device(s) that you want to check are running the monitor. In the next steps of this example, you assign the monitor to a single device, and then, using the Action Builder, configure and assign an Email Action to notify you when the monitor goes down.

Tip: You can also assign the monitor to multiple devices at one time via Bulk Field Change. For more information, see Assigning a monitor to multiple devices.

To assign the Norton AntiVirus Monitor, and configure and assign an Email Action:

Go to the properties for the device to which you want to assign the monitor.
- From either the Device View or Map View, right-click the device. The right-click menu appears.
- Select Properties. The Device Properties dialog appears.
Click Active Monitors. The Device Properties - Active Monitors dialog appears.
Click Add. The Active Monitor Properties dialog appears.
Select the Norton AntiVirus Monitor, then click Next.
Set the monitor polling properties, then click Next.
Select Apply individual actions, then click Add. The Action Builder appears.
Select Create a new action, then click Next.
Select the Email Action, then click Next.
Under Execute the action on the following state change, select 20 minutes (Down at least 20 min). This option specifies that WhatsUp Gold issues a state change after the monitor has been unable to find rtvscan.exe on the device for 20 minutes.
Click Finish. The New Email Action dialog appears.
Note: On the console, ensure that the Mail Destination tab is selected.
Enter a Name for the monitor, such as Norton AntiVirus Email Notification.
In SMTP Mail Server, enter the IP address or Host (DNS) name of your email server (SMTP mail host).
Enter the Port on which the SMTP Server is installed. The default SMTP port is 25.
Optionally, change the Timeout from the default of 5 seconds.
In Mail To, enter the email addresses to which you want send the notification. You can enter two addresses, separated by commas (with no spaces). The address should not contain brackets, spaces, quotation marks, or parentheses.
Select SMTP server requires authentication if your SMTP server uses authentication. This enables the Username and Password boxes.
Enter a Username and Password to be used with authentication.
Select Use an encrypted connection (SSL/TLS) if your SMTP server requires data encryption over a TLS connection.
Click Mail Content to enter the notification content.
In From, enter the email address that will appear in the From field of the email that is sent from WhatsUp Gold.
In Subject, enter %ActiveMonitor.Name has failed (%Device.HostName). This message indicates the monitor's name, its failed state, and the hostname of the device on which the monitor has failed.
In Message body, enter
This %ActiveMonitor.Name has failed on %Device.Address.

Please restart the Norton AntiVirus software on this device.

----------------------------------------

This mail was sent on %System.Date at %System.Time
Ipswitch WhatsUp Gold

This message indicates that the Norton AntiVirus software has stopped on the specified device and that it should be restarted.

Tip: Optionally, you can add a link to the Device Status or Mobile Device Status report for the device to which the monitor is assigned.
Click OK to save changes.
On the Active Monitor Properties dialog, click Finish.