Monitor, alert, and restart a Windows service with SAM

11/29/2018 10:34 PM

12/21/2022 2:49 PM

This article describes how to create a basic SAM application monitor template that includes a Windows Service Monitor to track status and statistics for a Windows service. After assigning the template to a target node, you can configure an alert.  

Related documentation topics include:

• Use SAM application monitor templates and application monitors
  • Create custom application monitor templates
  • Work with component monitors
  • Edit component monitors in templates and application monitors
  • Monitor and restart stopped Windows services
• Common SAM template elements (video)
• How alerts work in SAM
• Add a new alert (video)

Server Application Monitor

Create an application monitor template to monitor a Windows service

This example shows how to set up monitoring for a Trend Micro service called ntrtscan. You can also check OS and third-party software documentation to determine which services warrant monitoring, and then add them to your template, as desired.

1. Determine the exact service name. 
   1. In Windows, click Start > Administrative Tools > Services.
   2. Right-click the service you want to monitor and select Properties to display the formal name in the Properties dialog box.
2. In the Orion Web Console, navigate to Settings > All Settings > SAM Settings > Create a New Template.
3. Enter a Template Name and Description.
4. In the Component Monitors section:
   1. Click Add Component Monitors.
   2. On the No Component Selected dialog box, search for and select the Windows Service Monitor.
   3. Click Add.
5. On the Edit Template page, provide details about the component monitor being added. For reference, see Windows Service Monitor. 
   1. Specify the service you want to monitor in the Description field. 
   2. Select credentials or choose to Inherit Credentials from Node.
   3. Manually enter thresholds or select Use thresholds calculated from baseline data. For reference, see Manage application monitor thresholds in SAM .
   4. Enter the Fetching Method and Net Service Name. In this example, ntrtscan is a scanning service included in the TrendMicro antivirus application.
      
   5. Click Submit.
6. Assign your template to one or more nodes. When you assign a template to a node, SAM creates an individual application monitor (also called an "application") to the node(s).

After the next polling cycle (every 5 minutes, by default), SAM displays the service status on the Application Summary - Summary page.
 

Configure an alert for the service you're monitoring 

To add a basic alert that notifies you if the service goes Down or operates outside of set thresholds, see Create an alert for monitored components in SAM. For an overview, watch Add a new alert.

To add an alert that automatically restarts a service, follow these steps:

1. Click Alerts & Activity > Alerts, and click Manage Alerts.

2. On the Manage Alerts page, click Add New Alert.
3. On the Properties tab, enter a name, description, set the trigger checking frequency, and set the severity. (The severity helps group the triggered alerts.) Click Next.
4. On the Trigger Conditions tab, specify the alert. In the following example, Component Type 9 means it will only alert on Windows Service Monitor component types. Please note that, due to how alert variables work, the restart service alert action only works with a Component alert. For details, see SAM alert variables.

Here is another Trigger Condition example that looks for any component that is Down:

 

Configure trigger actions to restart the service from the alert 

1. Go to the Trigger Actions tab of your alert. 

2. Click Add Action.

3. In the Add Action dialog box, select Execute an External Program, and then click Configure Action.
4. Under Network path to external program, insert the following:
   APM\APMServiceControl.exe ${N=SwisEntity;M=ComponentAlert.ComponentID} -c=RESTART
   
5. Click Add Action and save the alert.

NOTES:

• The action to restart the service uses the credentials which the component is currently being monitored with.
• WMI requires administrator privileges on the target machine by default. There may be permission issues if the accounts have limitations. SolarWinds Technical Support cannot assist with the creation of a least-privileged Windows user account, nor the assignment of permissions. More information can be found here: How to create a non-administrator user for SAM polling .
• Agent: if polling the service via Windows agent, the agent runs under the context of the LocalSystem account on the target machine which should have sufficient privileges to restart the service.
• The restart service alerting action will only work with a component monitor based alert.  It you have your alert set up as an "I want to alert on an application monitor" (see the part about trigger conditions), the restart service alert action will not function.