Submit a ticketCall us

AnnouncementsAre You “Flying Blind?”

When it comes to your complex IT infrastructure, you want to ensure you have a good grasp of what’s going on to avoid any fire drills that result from guesswork. Read our white paper to learn how proactively monitoring your IT environment can help your organization while giving you peace of mind.

Get your free white paper.

Home > Success Center > Server & Application Monitor (SAM) > SAM - Knowledgebase Articles > Monitor, alert and restart a Windows service from SAM

Monitor, alert and restart a Windows service from SAM


This article provides steps to monitor, alert and restart Windows services in SAM from a Windows Service Monitor component. 


SAM 6.2 and later


1. Monitor Windows services  

TIP! Browse Trend Micro’s documentation to determine what services are used and warrant monitoring. You can then add them to your template as desired.

TIP! The Net Service Name is the name of the service you want to monitor. You can find the Service name on Windows systems by navigating to Start > Administrative Tools > Services and then locating the desired service. Right-click the service and select Properties from the context menu. The Service name is the value of the Service name field in the Properties dialog.

  1. In the Orion Web Console, navigate to Settings > SAM Settings > Create a New Template.
  2. Enter a name for the template then click Add Component Monitor and select Windows Service Monitor. When done, click Add.
  3. Select credentials or choose to Inherit Credentials from Node.
  4. Manually enter thresholds or check, Use thresholds calculated from baseline data.
  5. Enter the Fetching Method and Net Service Name. In this example, ntrtscan is a scanning service of TrendMicro antivirus:
  6. When Done, Click Submit
  7. You can optionally add additional monitors and then apply the template to a node for monitoring. For example, the following monitors were added to create the Trend Micro OfficeScan Template:


2. Configure trigger conditions for an alert on Windows services  

  1. Go to Settings > All Settings.

  2. Click Manage Alerts and create a new alert.

  3. Under the Trigger Conditions, specify the alert. In the following example, Component Type 9 means it will only alert on Windows Service Monitor component types. Please note, due to the way variables within alerting work, the restart service alert action will ONLY work with a Component alert.  More information can be found in SAM alert variables.

Another Trigger Condition example:


This trigger is looking for any component that is down within the specified template:



3. Configure trigger conditions to restart the service from the alert

  1. Go to the Trigger Actions section of your alert. 

  2. Add a new action.

  3. Select Execute an External Program.
  4. Under Network path to external program, insert the following:
    APM\APMServiceControl.exe ${N=SwisEntity;M=ComponentAlert.ComponentID} -c=RESTART

  5. Click Add Action and save the alert.



  • The action to restart the service uses the credentials which the component is currently being monitored with.
  • WMI: this requires administrator privileges on the target machine by default. There may be permission issues if the accounts have limitations. SolarWinds Technical Support cannot assist with the creation of a least-privileged Windows user account, nor the assignment of permissions. More information can be found in How to create a non-administrator user for SAM polling.
  • Agent: if polling the service via Windows agent, the agent runs under the context of the LocalSystem account on the target machine which should have sufficient privileges to restart the service.
  • The restart a service alerting action will only work with a component monitor based alert.  It you have your alert set up as an "I want to alert on an applicaton monitor" (see the part on trigger condition), the restart service alert action will not function. 



Last modified