I got it working. Thanks for the tip. <div>On 10/10/08, Aaron Segura <<a href="mailto:Aaron.Segura@cabelas.com">Aaron.Segura@cabelas.com</a>> wrote: <blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"> <div lang="EN-US" vlink="purple" link="blue"> <div> Yes. Note the '-u' option. $ ./check_procs -h check_procs (nagios-plugins 1.4.2) 1.46 Copyright (c) 1999 Ethan Galstad <<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:nagios@nagios.org" target="_blank">nagios@nagios.org</a>>Copyright (c) 2000-2004 Nagios Plugin Development Team <<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:nagiosplug-devel@lists.sourceforge.net" target="_blank">nagiosplug-devel@lists.sourceforge.net</a>> Checks all processes and generates WARNING or CRITICAL states if the specified metric is outside the required threshold ranges. The metric defaults to number of processes. Search filters can be applied to limit the processes to check. Usage: check_procs -w <range> -c <range> [-m metric] [-s state] [-p ppid] [-u user] [-r rss] [-z vsz] [-P %cpu] [-a argument-array] [-C command] [-t timeout] [-v] Required Arguments: -w, --warning=RANGE Generate warning state if metric is outside this range -c, --critical=RANGE Generate critical state if metric is outside this range Optional Arguments: -m, --metric=TYPE Check thresholds against metric. Valid types: PROCS - number of processes (default) VSZ - virtual memory size RSS - resident set memory size CPU - percentage cpu ELAPSED - time elapsed in seconds -t, --timeout=INTEGER Seconds before connection times out (default: 10) -v, --verbose Extra information. Up to 3 verbosity levels Optional Filters: -s, --state=STATUSFLAGS Only scan for processes that have, in the output of `ps`, one or more of the status flags you specify (for example R, Z, S, RS, RSZDT, plus others based on the output of your 'ps' command). -p, --ppid=PPID Only scan for children of the parent process ID indicated. -z, --vsz=VSZ Only scan for processes with vsz higher than indicated. -r, --rss=RSS Only scan for processes with rss higher than indicated. -P, --pcpu=PCPU Only scan for processes with pcpu higher than indicated. -u, --user=USER Only scan for processes with user name or ID indicated. -a, --argument-array=STRING Only scan for processes with args that contain STRING. -C, --command=COMMAND Only scan for exact matches of COMMAND (without path). RANGEs are specified 'min:max' or 'min:' or ':max' (or 'max'). If specified 'max:min', a warning status will be generated if the count is inside the specified range This plugin checks the number of currently running processes and generates WARNING or CRITICAL states if the process count is outside the specified threshold ranges. The process count can be filtered by process owner, parent process PID, current state (e.g., 'Z'), or may be the total number of running processes Examples: check_procs -w 2:2 -c 2:1024 -C portsentry Warning if not two processes with command name portsentry. Critical if < 2 or > 1024 processes check_procs -w 10 -a '/usr/local/bin/perl' -u root Warning alert if > 10 processes with command arguments containing '/usr/local/bin/perl' and owned by root check_procs -w 50000 -c 100000 --metric=VSZ Alert if vsz of any processes over 50K or 100K check_procs -w 10 -c 20 --metric=CPU Alert if cpu of any processes over 10% or 20% <div> <div style="TEXT-ALIGN: center" align="center"> <hr align="center" width="100%" size="2"> </div> From: Kenneth Holter [mailto:<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:kenneho.ndu@gmail.com" target="_blank">kenneho.ndu@gmail.com</a>] Sent: Friday, October 10, 2008 8:18 AM To: <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:nagios-users@lists.sourceforge.net" target="_blank">nagios-users@lists.sourceforge.net</a> Subject: [Nagios-users] Monitoring which user is running a service/process</div> <div> <div> Hello all.</div> <div> </div> <div> </div> <div> I have some processes that are meant to be run by user A, but are often (for some human error reason) run by the root user. Is there a way to set up Nagios to alert me whenever this happens? </div> <div> </div> <div> </div> <div> Regards,</div> <div> Kenneth Holter</div></div></div></div></blockquote></div>