I just wanted to add a few bits of information to remove some ambiguities:
in the process-based monitoring it’s important to understand those comma delimited parameters:
service[named]=x,x,x,/scripts/restartsrvr_bind,named,named|bind

where the first three don’t apply, which is why they are “x”

#4 is the command to start the service. My personal beef with it, by the way, is that I suspect it runs under user name “cpanel” which is usually not in your normal list of sudoers – important if the command needs to be run as a different user – I’m still doing a research on this.

#5 is basically NOT not command name and rather a search term for grep (I don’t know if searchd actually uses grep but the result is the same)
so, if you are monitoring “named” but you have this command running ” pico /etc/init.d/named”, it will think “named” itself is running – have to be very careful with it, especially if the command name is rather common

#6 is also rather tricky – it is the user that runs the command given in in #5. If the command is present but it’s run by, say, “root” instead of “named”, it will NOT match, even if “named” (the command) is actually running. And the notation you have in your example means that it will match if the “named” (a command name match) is run by either “named” (the user) or “bind”

Hope that can help someone from running in circles – there is very little info on that on the Net.

If someone knows exactly how chkservd runs the commands (as “root”, as “cpanel”, how to control paths etc.), please add some info here for the full(est) coverage of this little sucker I’ve seen anywhere, including cPanel’s own documentation.

Cheers everyone, keep up great work!