Windows Service Monitor - False Alerts

Scenario : We have a custom Service Monitor that is created long back and enabled for all Servers. I just noted that the service is not present in all servers except few. I also noticed that there are some Overrides for 5 servers which does
not make any sense to me as it was overridden to enable this monitor.
Issue : Now the issue is, I got alerts for 5 servers for which the service is not installed at all. How is that possible ?
S.Arun Prasath HP ARDE TEAM

HOw to you create this service monitor?
You can create your service monitor either
1) From Authoring workspace --> Management pack Templates --> Windows services
http://www.bictt.com/blogs/bictt.php/2011/03/17/scom-monitoring-a-service-part3
OR
2) Authoring workspace --> Monitors
http://www.bictt.com/blogs/bictt.php/2011/03/17/scom-monitoring-a-service-part2
You understanding is correct if you using method 1) to create service monitor. Otherwise, you should enable the monitor for computer which has te service present.
Roger

Similar Messages

Windows Service Monitoring

Hello All,
I have implemented a Windows Service Monitoring to look after some custom windows services on a Windows Server with a 3rd party piece of software installed. The monitor has been working as expected and has kept an eye on the services and alerted when they
have stopped.
However, the support team are now reporting that they are alerted when the service stops and starts. And they receive the same alert regardless, stating that the service has been stopped.
Is there something I am missing from my configuration? How can I amend it so that the support team are only alerted when the service is stopped? And why would it alert when its started?
Hope someone can help
James

This actually sounds like a notification issue. Do they have notifications set up to send them emails when an alert goes from one state to the next? What I mean by that is, New Alert, Closed Alert. When setting up notifications, it's a
common mistake to not include the alert criteria, which will cause behavior like this, ops teams getting several emails when the state of the alert is changed by the system or operator. If you look at the alert details in the email, you may notice, a
slight difference in the resolution state field, if that is displayed.
If this is the issue, find the notification subscription and have it changed so that they only receive alerts with a resolution state of NEW.
Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/ If my response was helpful, please mark it as so, if it answered your question, then please also mark it accordingly. Thank you.

Service Monitor Not Alerting

I have a service monitor setup to monitor up down of a service. The service yesterday starting to terminate and restart it self but the monitor is not catching that it is going down. The monitor works fine we we take it down manually. I think the restart
is happening too quickly. Has anyone seen something like this and is there a fix for it?

Hi,
The default frequency of the basic service monitor is 60 Seconds if I have it in mind correctly so you may not got an alert for every service restart.
If you want to get an alert for every service restart you may have to use an Event Monitor to check the Service Start/Stop Events.
Have a look on this thread also:
http://www.systemcentercentral.com/forums-archive/topic/question-about-the-poll-time-of-the-basic-service-monitor/
Cheers,
Christoph
Blog: http://blog.cmaresch.at/ Twitter:
LinkedIn:
XING:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Cluster monitoring false alerts

I have a cluster in monitoring which has many shared disks in monitoring.
Recently I have been receiving false alerts for 2 of the disks for low disk space with every poll & secondly the disks labelling seems to be wrong as per the actual labeling.
Is there a way in which I can manually change the disks labeling or with any hotfix?

Hi,
Have you imported New Base OS MP 6.0.7026.0? It fixed bug 'Cluster Disk Free Space Percent' and Cluster Disk Free Space MB' monitors generate alerts with bad descriptions when the volume label of a cluster disk is empty.
http://blogs.technet.com/b/kevinholman/archive/2013/05/09/opsmgr-mp-update-new-base-os-mp-6-0-7026-0.aspx
Niki Han
TechNet Community Support

SCOM monitoring on windows services in starting or stopping state

Hi,
Any chance if somebody can help me to set alarm on stopping and starting state windows services (automatic services) in SCOM for client servers.
Balys

1) Using Windows Service Template to create a windows service monitor with enabled "monitor only automatic service" option
2) Export the management pack containing the monitor which created in step 1)
3) Modidy data source from
TypeID="Windows!Microsoft.Windows.Win32ServiceInformationProviderWithClassSnapshotDataMapper">
    <ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
    <ServiceName>XXXX</ServiceName>
into
TypeID="Windows!Microsoft.Windows.WmiProviderWithClassSnapshotDataMapper">
    <NameSpace>root\cimv2</NameSpace>
    <Query>select * from win32_service </Query>
AND
<Setting>
          <Name>$MPElement[Name="MicrosoftSystemCenterNTServiceLibrary!Microsoft.SystemCenter.NTService"]/ServiceProcessName$</Name>
          <Value>$Data/Property[@Name='BinaryPathName']$</Value>
        </Setting>
into
<Setting>
          <Name>$MPElement[Name="MicrosoftSystemCenterNTServiceLibrary!Microsoft.SystemCenter.NTService"]/ServiceProcessName$</Name>
          <Value>$Data/Property[@Name='PathName']$</Value>
        </Setting>
4) Import the management pack
http://blogs.technet.com/b/brianwren/archive/2008/03/07/using-wildcards-with-the-windows-service-template.aspx
Roger

Service Monitoring in SCOM which triggers an alert after a wait time

Hi ,
I have a requirement to amend on of our services monitors to alert after waiting for 3 minutes after the service goes down.
Is this possible using SCOM or do we need to script this.
Please advise.
Jesty

For configure that using script, you can refer below link
http://blogs.technet.com/b/fesiro/archive/2012/11/26/how-to-configure-command-notification-in-scom-2012-with-powershell-script.aspx
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
Mai Ali | My blog: Technical | Twitter:
Mai Ali

Displaying hostname in Basic Service Monitor alerts

Hi all,
I've created a new Unit Monitor (specifically, a Basic Service Monitor) to alert when a particular service I stopped on any server in a group that I've defined. When I stop the service to test the alert, I don't see the affected server's hostname anywhere in
the alert. I see the source is set to the name of the group. This isn't all that useful, as I have to check every server until I find the one that the alert was generated for.
I've tried changing values in the Alert Description on the monitor, but haven't had any success here. It seems to me like the answer should be pretty obvious, but I'm stumped.
Thanks!

First - monitors or rules targeting groups is a
bad practice.
http://blog.scomskills.com/best-practices-targeting-intro/
Also, getting hostname in the alert is a
discovery issue.
http://blogs.technet.com/b/jonathanalmquist/archive/2010/06/18/why-does-source-not-show-me-the-computer-name-that-generated-the-alert.aspx
Jonathan Almquist | SCOMskills, LLC (http://scomskills.com)

SQL Server Agent Windows Service

I have created a override for parameter, Alert only if service startup type is automatic in monitor SQL Server Agent Windows Service to false, as my SQL Admin informs that this service startup type is Manual. As SQL servers are clustered, even SQL agent
service runs on even node and odd SQL agent service runs on the odd node. Should this resolve the issue my SQL Admin's are complaining they were not receiving notifications for SQL Agent stopping. Or, should it create noise as I should expect alerts from odd
SQL Agent service that are not running on even node and vice versa.
From SQL Server end,
Thanks, Harry :-)

Hi,
The below article should be helpful:
Monitoring Clusters by Using Operations Manager
http://technet.microsoft.com/en-us/library/hh212773.aspx
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

How to create Service Monitor - best Way

I have a task at hand :
Creating monitor to alert when a service is stopped.
We are using SCOM 2012
I checked and found various ways to do so http://www.bictt.com/blogs/bictt.php/2011/03/16/scom-monitoring-a-service-part1
My requirement is : there are like 100 such services on 100 different windows computers that i need to monitor.
The services are not common , so 2 computers have the same service , Maybe some service that i need to be monitored be on 2 computers but overall every service is unique.
What is my best option:
1.Create a basic unit monitor and target to Windows computer class ? Create is as disabled ? Override for just the machine that has it.
Will it clutter my Windows Server class health explorer . (How bad is that as per performance)
2.Create a Service monitor using Windows Service templates
Do i have to create 100 target groups , as i have to Target the monitor to specific computer only
Since template service monitor create discoveries , targets etc on its own (Am i going to clutter SCOM with a lot of those) 100
3.Do i create a attribute for each service , so as to extend the windows base class to discover the computer that has specific service (Using registry)
too much work is it and how good of an option is this.
4.MP Authoring ,Create new class discovery based on WMI / Registry to find computer and then target the monitor
What would you do in such a case.

An example is the windows service monitoring from the Windows Management Packs. Microsoft does not discover any of these services. The MPs discover the Windows 2003 \ 2008 \ 2012 Operating System Class and the basic service monitors are targetted at
this class. This means it is relatively light weight monitoring (less overhead on the agent and less discovery information in the databases) but it does mean that you can't add any of these services to a distributed application or report on their availability.
You don't report on individual monitors but on objects which may have many monitors targetted at them.
Windows Server 2003
ü
Computer Browser Service
ü
DHCP Client Service
ü
DNS Client Service
ü
Plug and Play Service
ü
RPC Service
ü
Server Service
ü
TCP \ IP NetBios Service
ü
Windows Event Log Service
ü
Workstation Service
Windows Server 2008 (including R2)
ü
Computer Browser Service
ü
DHCP Client Service
ü
DNS Client Service
ü
Plug and Play Service
ü
RPC Service
ü
Server Service
ü
TCP \ IP NetBios Service
ü
Windows Event Log Service
ü
Workstation Service
Windows Server 2012
ü
Computer Browser Service
ü
DHCP Client Service
ü
DNS Client Service
ü
Plug and Play Service
ü
RPC Service
ü
Server Service
ü
TCP \ IP NetBios Service
ü
Windows Event Log Service
ü
Workstation Service
If you want to actually report on the availability of this windows service (or add it to a Distributed Application) then you do need to discover it - either via the Authoring Template or authoring your own discoveries.
Only you can decide what you need and you might have a different need for each service depending on what it is doing.
Jonathan Almquist has a good walk through here about how to change service monitoring to allow for consecutive occurrences of a service being unavailable but it is deep authoring.
http://blogs.technet.com/b/jonathanalmquist/archive/2011/06/24/windows-service-monitoring-reduce-false-alerts-part-2.aspx
Regards Graham New System Center 2012 Blog! -
http://www.systemcentersolutions.co.uk
View OpsMgr tips and tricks at
http://systemcentersolutions.wordpress.com/

Windows Service no longer able to print PDF files using Adobe Reader 11.0.07.79

We have a Windows Service that watches a folder for PDF files to be deposited. Once awakened, it executes the Adobe Reader in command line mode to print the PDF files to secure check printers. The Windows Service was working fine with 11.0.06.70 but no longer works with 11.0.07.79.
There are no event viewer errors or errors returned to our Process.Start() call. The Windows Service is running under the identify of an administrator account and has explicit full access to the printer. We have also tried the local computer's Administrator account as well as the default Local Service, but none work.
Using ProcMon to examine the failure, it showed Adobe Reader making many successful registry and file accesses. Adobe Reader then creates a new process, another instance of itself to read in the PDF file and print to the printer. However, ProcMon only shows Adobe Reader accessing AcroRd32.exe, syswow.dll (sp) and ntdll.dll and then the thread and process immediately exits with an exit code of 0 (no file or registry accesses). So, something is causing the instantiated process to fail immediately.
After more research and trying many things, we disabled "Enable Protected Mode at Startup". This enabled things to work again.
We are concerned that disabling this feature might expose security concerns for our customers.
We are suspecting that some security concerns were tightened with 11.0.07.79 that has inadvertently caused printing from Windows Services to falsely be identified as security violations. Can you please investigate and provide a resolution?
Thank you.
Craig Keating
Alliance Enterprises, Inc.
[email protected]

Hi,
Can you please give the following details:
1) Command (given in command line)used to print PDF files?
2) Is the issue reproducible with other printers as well?
3) Is directly printing the PDF from that folder using command line i.e without using windows service works fine or not?
Thanks,
Shakti K

SQL server Analysis Windows service Alerts on cluster nodes

Hi,
I was wondering if others may be experiencing the same issue with the SQL Server MP.
We are monitoring SQL server Analysis Service using monitor SQL Server Analysis Service Windows Service.
We had overrided “Alert only if service startup type is automatic”
option to false.
It will create the false alerts from the other nodes in the cluster on which service is not running, but since it's in clustered configuration, it should not generate alerts from other node as it's running on another node on the same cluster.
Please share if anyone has been through this issue and any remediation for this kind of issue.
Regards,
Daya Ram

Hi,
Here is a similar thread for your reference, in the thread, this issue has been confirmed as bug, and the poster provided a work arround for it, please try the work around:
Problem with the discovery of clustered SQL Server Analysis Services objects
http://social.technet.microsoft.com/Forums/en-US/ead946fd-38d1-4627-b60d-a5645d3627fb/problem-with-the-discovery-of-clustered-sql-server-analysis-services-objects?forum=operationsmanagergeneral
Hope this helps.
Regards,
Yan Li
Regards, Yan Li

How to configure windows services alerts in SCOM 2012 for all agent servers. For eg, Terminal Services, Netlogon, RPC etc..

Hi,
I need to configure different windows services alerts in SCOM 2012. Below are some of the windows services I need to monitor through SCOM.
Serivce: Windows Management Instrumentation
Service: Netlogon
Service: Remote Procedure Call (RPC)
Service: Server Service
Service: Terminal Services
Service: Windows Time
Service: Workstation
Service : WWW Publishing Service
Could some one please assist or share me the details, how to configure these services for windows agent servers.
Thanks..
Regards, Rajeev Parambil

Hi,
A certain set of services are monitored by default on all agents:
DNS Client
DHCP Client
RPC
Workstation
Server
For all the other services you could create a service monitor.
A nice blog series outlining this process can be found here: http://www.bictt.com/blogs/bictt.php/2011/03/16/scom-monitoring-a-service-part1
It's doing common things uncommonly well that brings succes. Check out my SCOM link blog:
SCOM link blog

How to disable a specific windows service from a monitor?

Hi,
Recently I created a SCOM 2012 R2 Pool to mange around 40 Win 2012 servers, however from the first day i got heaps of RemoteRegistry Services stopped alert.
What i want to do is to disable the RemoteRegistry Service monitoring, but still can hear the voice from other services.
From the Service Alert Monitor : "Service Running State", i have following options to disable
1.: For the object: RemoteRegistry, it's OK, but i don't want to do it 40 times.
2.For the objects of Class: Windows.ServiceClass: it will disable all Service monitoring
3. For a group: same, stop all services
4 . For a Specific object of class: Windows.SersviceClass, i can't choose multiple servers.
5. For all objects of another class: no idea what to choose.
Anyone has same experience like this? thanks!

You will need to Select override For all objects of class:
Class and disable monitoring Services and select enforce to ensure that applied.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
Mai Ali | My blog: Technical | Twitter:
Mai Ali

Create metric alert in OEM 12c for windows services

Hi,
I was wondering if there is a way to create metric alert for services on a windows host, so that when any service is in stopped state, we will get an alert.
We can check the status of services from OEM that are running in a windows server.
Host -> Monitoring -> All Metrics -> Services
I got below command from this forum that was posted a long time ago,
nmefwmi "wbem_wql=select name, pathname, processid, Started, startmode, state, status from win32_service" "wbem_wql_column_order=name, pathname, processid, Started, startmode, state, status" "wbem_namespace=root\cimv2"
However, I am not sure where to run this command. Basically we want to get an alert when a windows service stops.

Hi Abid,
Ensure you are logged in as sysman user or any other super Admin user
Go to Host -> Monitoring -> All Metrics -> Services >
Next to Collection Schedule there is a modify button > click on that
It will show a new page having following options
Data Collection Enabled Disabled (Select Enabled here)
Frequency
Default is 15 min , if you want then you can change it accordingly
Regards,
Rahul

ABAP Central Service not available alert in Technical Monitoring

Hi Gurus,
Need help with this alert which i am getting from Solman 7.1 SP10.
ABAP Message Server Status
XXX-ABAP
3
3
3
No process found for: msg_server(.*)
I have already checked following notes but no luck
1419603 - Missing ABAP SAP Central Services (ASCS) instance in SLD/LMDB
1916237 - ABAP Central Service not available alert in Technical Monitoring
Our managed system kernel is 720 P 401 as per-requisites for the sld registration.
Have tried few things here and there but no luck.
Please suggest is any has any suggestion or solution.
Dev

Hi Roland,
I followed the note 1717846 and performed all the steps successfully.. But still no luck with ASCS in SLD.
Any ideas or suggestions .?
Attaching the logs for your reference:
Tue Apr 15 15:52:23 2014 Parsing XML document.
Tue Apr 15 15:52:23 2014 Supplier Name: BCControlInstance
Tue Apr 15 15:52:23 2014 Supplier Version: 1.0
Tue Apr 15 15:52:23 2014 Supplier Vendor:
Tue Apr 15 15:52:23 2014 CIM Model Version: 1.5.29
Tue Apr 15 15:52:23 2014 Using destination file '/usr/sap/XXX/SYS/global/slddest.cfg'.
Tue Apr 15 15:52:23 2014 Use binary key file '/usr/sap/XXX/SYS/global/slddest.cfg.key' for data decryption
Tue Apr 15 15:52:23 2014 Use encryted destination file '/usr/sap/XXX/SYS/global/slddest.cfg' as data source
Tue Apr 15 15:52:23 2014 HTTP trace: false
Tue Apr 15 15:52:23 2014 Data trace: false
Tue Apr 15 15:52:23 2014 Using destination file '/usr/sap/XXX/SYS/global/slddest.cfg'.
Tue Apr 15 15:52:23 2014 Use binary key file '/usr/sap/XXX/SYS/global/slddest.cfg.key' for data decryption
Tue Apr 15 15:52:23 2014 Use encryted destination file '/usr/sap/xXX/SYS/global/slddest.cfg' as data source
Tue Apr 15 15:52:23 2014 ******************************
Tue Apr 15 15:52:23 2014 *** Start SLD Registration ***
Tue Apr 15 15:52:23 2014 ******************************
Tue Apr 15 15:52:23 2014 HTTP open timeout = 420 sec
Tue Apr 15 15:52:23 2014 HTTP send timeout = 420 sec
Tue Apr 15 15:52:23 2014 HTTP response timeout = 420 sec
Tue Apr 15 15:52:23 2014 Used URL: http://sapr6bv:51600/sld/ds
Tue Apr 15 15:52:23 2014 HTTP open status: true - NI RC=1
Tue Apr 15 15:52:23 2014 HTTP send successful.
Tue Apr 15 15:52:23 2014 Return code: 200 --- Return message: (OK)
Tue Apr 15 15:52:23 2014 HTTP response: Success. HTTP status code: 200
Tue Apr 15 15:52:23 2014 ****************************
Tue Apr 15 15:52:23 2014 *** End SLD Registration ***
Tue Apr 15 15:52:23 2014 ****************************

Windows Service Monitor - False Alerts

Similar Messages

Maybe you are looking for