Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Monitoring Deep Security services

    • Updated:
    • 4 Mar 2019
    • Product/Version:
    • Deep Security 10.0
    • Deep Security 10.1
    • Deep Security 10.2
    • Deep Security 10.3
    • Deep Security 11.0
    • Deep Security 11.1
    • Deep Security 11.2
    • Deep Security 11.3
    • Deep Security 9.6
    • Deep Security as a Service All.All
    • Platform:
    • N/A N/A
Summary

Learn how to monitor the processes and services of Deep Security Manager (DSM) and Deep Security Agent (DSA).

Details
Public

Windows

To monitor Deep Security Manager service, run "tasklist" or/and "sc" command to confirm the process and service below are running:

  • Process name: Deep Security Manager.exe
  • Service name: Trend Micro Deep Security Manager

Linux

To monitor Deep Security Manager service, use ps -ef command to ensure the process below is running:

  • Process name: /opt/dsm/jre/bin/java

Windows

Usually, you can check the Deep Security Manager's user interface to ensure agent status is green. You can also monitor the following processes to verify that the agent is under normal status:

  • Process names
    • dsa.exe (Agent's main process)
    • Notifier.exe (Deep Security Notifier's process)
    • coreFrameworkHost.exe (Anti-malware scan process)1
    • coreServiceShell.exe (Anti-malware scan process)1
    • dsvp (Relay server process)2
    • nginx (Used to connect proxy server)2
  • Service names
    • ds_agent (Agent Service)
    • ds_notifier (Agent Notifier Service)
    • Amsp (Anti-malware Service)1
  • Driver: tbimdsa (Common driver for Web Reputation Service/Firewall/Intrusion Prevention System)3

1 Process/Service is running when Anti-Malware is enabled.

2 Process/Service is running when Relay is enabled.

3 Driver is loaded when Web Reputation Service or/and Firewall or/and Intrusion Prevention System are enabled.

Linux

Check the following processes and driver:

  • Process names
    • ds_agent (Agent's main process)1
    • ds_am (Anti-malware scan process)2
    • dsvp (Relay server process)3
    • nginx (Used to connect proxy server)3
  • Driver: dsa_filter (Common driver for Web Reputation Service/Firewall/Intrusion Prevention System)4

1 The ds_agent has two processes. One is the main process and the other is for process monitoring.

2 The process will be running when Anti-Malware is enabled, as ds_agent two processes exist.

3 The process will be running when Relay is enabled.

4 Driver is loaded when Web Reputation Service or/and Firewall or/and Intrusion Prevention System are enabled.

To ensure the normal status, dvfilter-dsa should be running.

As VMsafe API is no longer supported by VMware, this driver does not exist starting on Deep Security 9.6.

Premium
Internal
Rating:
Category:
SPEC
Solution Id:
1122160
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.