Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Server & Application Monitor (SAM) > Monitor, alert and restart a Windows service from SAM

Monitor, alert and restart a Windows service from SAM

Overview

This article provides steps to monitor, alert and restart Windows services in SAM from a Windows Service Monitor component. 

Environment

SAM 6.2 and later

Steps

Monitor Windows services

  1. Open the Orion Web Console and go to Settings > SAM Settings.

  2. Click Component Monitor Wizard.
  3. Select Windows Service Monitor and click Next.
  4. Select the node and credentials with WMI access.
  5. Select the services you want to monitor.
  6. Add the services to a new template and specify a name. 

Configure trigger conditions for an alert on Windows services

  1. Go to Settings > All Settings.

  2. Click Manage Alerts and create a new alert.

  3. Under the Trigger Conditions, specify the alert. In the following example, Component Type 9 means it will only alert on Windows Service Monitor component types. More information can be found in SAM alert variables.

Another Trigger Condition example:

 

This trigger is looking for any component that is down within the specified template:

 

Configure trigger conditions to restart the service from the alert

  1. Go to the Trigger Actions section of your alert. 

  2. Add a new action.

  3. Select Execute an External Program.
  4. Under Network path to external program, insert the following:
    APM\APMServiceControl.exe ${N=SwisEntity;M=ComponentAlert.ComponentID} -c=RESTART
  5. Click Add Action and save the alert.

 

Notes:

  • The action to restart the service uses the credentials which the component is currently being monitored with.
  • WMI: this requires administrator privileges on the target machine by default. There may be permission issues if the accounts have limitations. SolarWinds Technical Support cannot assist with the creation of a least-privileged Windows user account, nor the assignment of permissions. More information can be found in How to create a non-administrator user for SAM polling.
  • Agent: if polling the service via Windows agent, the agent runs under the context of the LocalSystem account on the target machine which should have sufficient privileges to restart the service.

 

 

Last modified
14:25, 6 Jun 2017

Tags

Classifications

Public