Share via

Monitoring a service for State and StartMode

  • Article

I recently had a customer that wants to get an alert when a specific service is not Disabled and/or not Stopped.  I used the following steps to accomplish this using a "Timed Script Three State Monitor".  Even if you do not have this specific need, these steps can be used as a template for creating a monitor that uses a script to query WMI and change state or generate alerts based on the results.  If you don't have a need for three states (Critical, Warning, Healthy), there is a Two State Monitor that can be used for this.

 

Create a new Monitor, select Scripting\Generic\Timed Script Three State Monitor

image

Technorati Tags: Operations Manager,monitor,Three-state,Two-state,service

 

Give it a name, target, etc. (I targeted the Windows Computer class, but Windows Operating System may be a better choice).  I try to make a habit of unchecking "Monitor is enabled" and enabling it with an override later....at least while testing it:

 image

 

 

Set the schedule...this just depends on how quickly you want to know if the service gets changed:

image

 

Next, I used a basic VB script which accepts a service name as a parameter, queries WMI for the service, and puts the Service Name, State (Running, Stopped, etc.), and StartMode (Disabled, Manual, Automatic) into property bag values.  The full text of the script is below the screenshot:

image

 

---------------------------------------------------------------------------------------------------

Dim oAPI, oBag,strComputer
Set oAPI = CreateObject("MOM.ScriptAPI")
Set oBag = oAPI.CreatePropertyBag()
set oArgs=wscript.arguments
strComputer="."
ServName=oArgs(0)

Set namespace=GetObject("winmgmts:\\"& strComputer & "\root\cimv2")
set servinfo=namespace.ExecQuery("select * from win32_service where name =" & """" & servname & """")

for each objservice in servinfo

Call oBag.AddValue("ServiceName",ServName)
Call oBag.AddValue("State",objservice.State)
Call oBag.AddValue("StartMode",objservice.StartMode)
Call oAPI.Return(oBag)

next

---------------------------------------------------------------------------------------------------

For the script parameter, I just enter "ServiceName"....this will be replaced by an override later, or you can just enter your service name here:

image

Next, I set the "Unhealthy", "Degraded", and "Healthy" expressions for the monitor.  My goal is to set the state to Warning when the service is Stopped but NOT Disabled , Critical when it is NOT Stopped, and Healthy when it is Stopped AND Disabled.  I used the following expressions:

Unhealthy Expression:

Parameter Name: Property[@Name='State']

Operator: Does not equal

Value: Stopped

Degraded Expression:

Parameter Name: Property[@Name='StartMode']

Operator: Does not equal

Value: Disabled

AND

Parameter Name: Property[@Name='State']

Operator: Equals

Value: Stopped

 

Healthy Expression:

Parameter Name: Property[@Name='StartMode']

Operator: Equals

Value: Disabled

AND

Parameter Name: Property[@Name='State']

Operator: Equals

Value: Stopped

 

image

image

image

Next, I used the default settings for Health State, since they already match what I want to do:

image

Next, I configure the alert settings.  The settings in the screen shot below will generate a Warning alert when the monitor is in a Warning state (service is not Disabled), and a Critical alert when the monitor is in the Critical state (service is not Stopped).  The Alert Description will have the service name (using the ServiceName property created by the script):

image 

Now that I have the monitor created, I need to enable it and set the Override for the Service Name:

image

I'm using the Alerter service for my test:

image

To test the monitor, I first set the Alerter service to Manual Startup and leave it stopped:

image

Then I verify that I get the Warning alert:

image

Health Explorer correctly shows the "Degraded" Warning state:

image

Now I want to test the Critical state, so I start the Alerter Service:

image

Now the alert is changed to Critical:

image

And Health Explorer shows the "Unhealthy" Critical state:

image 

 

When I stop the service and disable it, the alert is auto-resolved and the state is changed back to Healthy:

image

 

 

I've attached my sample MP which includes the following monitors:

Service disabled and stopped - two-state monitor:

If the specified service is not Stopped AND Disabled, the computer will be put in a Warning state and a Warning alert will be generated.  When the service is stopped and disabled, the computer will be put in a Healthy state.

Service disabled and stopped - three-state monitor:

If the specified service is Stopped and is not Disabled, the computer will be put in a Warning state and a Warning alert will be generated.  If the specified service is not Stopped, the computer will be put in a critical state and a Critical alert will be generated.  When the service is stopped and disabled, the computer will be put in a Healthy state.

Usage:

Both monitors are targeted at the Windows Computer class and roll up to the Configuration Health.  Both monitors are disabled by default.  They are configured to check the service every 1 minute.  To enable one of the monitors, add an Override for the Computer or Group you wish to monitor and set the following Override parameters:

Enabled=True

Script Arguments = <Service Name>

 

Enjoy!!

Service.Monitor.MP.xml

Comments

  • Anonymous
    January 01, 2003
    We do have simpler ways to monitor a service....this script was provided for a way to do more granular monitoring of the service state and startup type. You can easily monitor a service by doing one of the following:
  1. Go to AuthoringManagement Pack Templates, run the "Add Monitoring" wizard and create a "Windows Service" monitor.  This will monitor all agents that run the service.
  2. Go to AuthoringManagement Pack ObjectsMonitors and create a new Unit Monitor, then select "Windows ServicesBasic Service Monitor".  This will allow you to target specific classes for the monitor.

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    You would need to change the script to query Win32_process in rootcimv2 (instead of Win32_Service), and use the "CreationDate" property to see how long it has been running.  I'm not 100% sure, but I think something like this will be included in the R2 release.

  • Anonymous
    October 03, 2008
    Thanks for the two/three state monitor sample. However I wonder if there is a way to add diagnostic task to automatically recover stopped service. Have yoe ever worked about it?

  • Anonymous
    October 06, 2008
    My question was not so clear. I plan to monitor several servers at a time. ex; services beginning with 'cisco' display name. Therefore I need to determine stopped service name and set service name with parameters within recovery task command lines without writing a custom script

  • Anonymous
    February 03, 2009
    The comment has been removed

  • Anonymous
    June 22, 2009
    How do I monitor a specific service on a specific server without having to create a script? I feel like monitoring services in OpsMgr R2 should be rudimentary but it's unbelievably convoluted.

  • Anonymous
    November 28, 2012
    Very nice, it give me a pointer how to monitoring if service hang in stopping state.

  • Anonymous
    March 28, 2014
    nicel,value add with respect to service Monitor creation.