Service Monitors – What does the “State” value mean?

When you create a Service Monitor in OpsMgr 2007, we get an alert / state change when the service is not running, but this does not necessarily mean that the service is “stopped”.  The monitor attempts to get the “State” of the service, and alerts when the State is not “Running”.  So, what other states are there?  Here is a list of possible service states, copied from https://msdn.microsoft.com/en-us/library/ms685996(VS.85).aspx:

 

 

However, I recently ran into an issue where we got an alert from a Service Monitor and Health Explorer showed that State=9:

 

After checking with the OpsMgr product group, I found that State=9 means “Server not found”, and we get this when we fail to open SCManaged with “RPC_S_SERVER_UNAVAILABLE”.  In this particular case, the problem was on a clustered server which had failed over to the second node, which did not have the OpsMgr Agent installed.

We also have two other states that are not listed in the above table.  State=8 means “Service not found” (we’re trying to monitor a service that does not exist on the agent), and State=0 means “Unknown state”….not sure exactly when we would see this.

So, here’s the final list of State values that you may see on a service monitor:

0 = MOM_SERVICE_UNKNOWN_STATE
1 = MOM_SERVICE_STOPPED
2 = MOM_SERVICE_START_PENDING
3 = MOM_SERVICE_STOP_PENDING
4 = MOM_SERVICE_RUNNING
5 = MOM_SERVICE_CONTINUE_PENDING
6 = MOM_SERVICE_PAUSE_PENDING
7 = MOM_SERVICE_PAUSED
8 = MOM_SERVICE_NOT_FOUND
9 = MOM_SERVER_NOT_FOUND