process.yaml

init_config:
  # the check will refresh the matching pid list every X seconds
  # except if it detects a change before. You might want to set it
  # low if you want to alert on process service checks.
  # pid_cache_duration: 120
  #
  # used to override the default procfs path, e.g. for docker containers with the outside fs mounted at /host/proc
  # DEPRECATED: please specify `procfs_path` globally in `datadog.conf` instead
  # procfs_path: /proc

instances:
- name: IIS Worker Process
  search_string: ['w3wp.exe']
# The `system.processes.cpu.pct` metric sent by this check is only accurate for processes that live
# for more than 30 seconds. Do not expect its value to be accurate for shorter-lived processes.
#
#  One and only one of search_string, pid or pid_file must be specified
#  - name: (required) STRING. It will be used to uniquely identify your metrics as they will be tagged with this name
#    search_string: LIST OF STRINGS. If one of the elements in the list matches,
#                   return the counter of all the processes that contain the string
#    pid: STRING. A Process id.
#    pid_file: STRING. A Pid file.
#    exact_match: (optional) Boolean. Default value of True matches your search_string on proc.name().
#                 If you want to match on a substring within proc.cmdline(), set this to False
#                 https://docs.datadoghq.com/agent/faq/i-have-issues-with-my-process-check-it-doesn-t-find-my-processes/
#    ignore_denied_access: (optional) Boolean. Default to True, when getting the number of files descriptors, dd-agent user might
#    get a denied access. Set this to true to not issue a warning if that happens.
#    thresholds: (optional) Two ranges: critical and warning
#         warning: (optional) List of two values: If the number of processes found is below the first value or
#                  above the second one, the process check will return WARNING.
#         critical: (optional) List of two values: If the number of processes found is below the first value or
#                   above the second one, the process check will return CRITICAL.
#     In this example, process check will return OK for 3 to 5 process. WARNING for 1, 2, 6, 7 processes and Critical below 1 or above 7.
#     CRITICAL is always dominant in case of overlapping.
#    collect_children: BOOLEAN. If true, the check will also collect metrics from all child processes of a matched process. Default to false.
#                      Please be aware that the collection is recursive, and might take some time depending on the use case.
#    user: STRING. Only report processes belonging to a specific user.
#    try_sudo: (optional) Boolean. If set to True (default is False), the check will try to use 'sudo' to collect the 'open_fd' metric on Unix platforms.
#
# Examples:
#
#  - name: ssh
#    search_string: ['ssh', 'sshd']
#    tags:
#      - env:staging
#      - cluster:big-data
#    thresholds:
#      critical if no sshd or more than 8 sshd are running
#      critical: [1, 7]
#      warning if 1, 2, 6, 7 sshd processes are running
#      warning: [3, 5]
#      ok if 3, 4, 5 processes are running
#.   try_sudo: False
#
#  - name: postgres
#    search_string: ['postgres']
#    ignore_denied_access: True
#
#  - name: nodeserver
#    search_string: ['node server.js']
#
#  - name: pid_process
#    pid: 1278
#    Do not use search_string when searching by pid or multiple processes will be grabbed
#
#  - name: pid_file
#    pid_file: /var/run/sshd.pid