We have hundreds of POS devices that are running a touchscreen. Randomly the touchscreens are crashing. We found the process that is crashing. It is a certain driver for a certain model of USB touchscreen.. What I am asking is.... How can I monitor the process if it crashes? It needs to be running, then crash and let me know.. any help? Thanks!
Does the process that crashes stop running when this happens? Also is this process running all the time when its working okay? If so then you can use the Process monitoring to check if the process is running or not.
If not then you need to look in the Eventlogs to see if there is a APP crash event (Application event ID 1000, source Application Error).
The process does run, then crashes. My problem is out of all these POS devices only some run that certain touchscreen process.. What I need to do is to find out what machines are currently running the process, then somehow flag them and then monitor them.. Tough because I still haven't found a way to find the hardware difference between machines.
Well the Application Error event might do then you will need to know of a computer that this has happened on and look at all the Application Error events. To narrow it down filter for the executable the process uses. So in theory the Application Error event will only occur on the computers that uses the process you want to monitor.
For a quick find of those devices, you could setup a new view that is filtering by Application contains then the .exe of the process. From there, if you can filter the 1000 event like HardKnoX suggested based on something useful, might be easiest, but if not then you try a monitor set looking at that process with an alarm threshold of 0. KNM should be able to monitor for a process as well. Beyond that, a procedure running a vbscript that checks if the process is running or not would be my next step.