MOM 2005 provides the ability to monitor the state of windows services running on a computer, and to generate state alerts when these services change. Using the MOM internal service monitoring feature and event processing rules, alerts may be generated when services you want to monitor are unavailable. Service monitoring provides internal MOM events on service state change every 30 seconds. Service states you might want to monitor include:
-
Service Start
-
Service Stop
-
Service Pause
Table 6.2 Internal service monitoring event details
|
Event Parameter
|
Value
|
|---|
|
Event ID
|
21207
|
|
Source
|
Microsoft Operations Manager
|
|
Parameter 1
|
Number of seconds from last sample
|
|
Parameter 2
|
Display Name (Localizable String)
|
|
Parameter 3
|
Old State (such as Running; Localizable String)
|
|
Parameter 4
|
New State (such as Running; Localizable String)
|
|
Parameter 5
|
Service Name (Short Name; Non Localized)
|
|
Parameter 6
|
Start Up Type (Localizable String)
|
|
Parameter 7
|
Service Context (Domain\User Name Service Runs under)
|
|
Parameter 8
|
Old State (such as Numeric; Non-Localizable)
|
|
Parameter 9
|
New State (such as: Numeric; Non-Localizable)
|
|
Parameter 10
|
Start Up Type (Numeric; Non-Localizable String)
|
Table 6.3 Values available for Service State
|
State
|
Value
|
|---|
|
Stopped
|
1
|
|
Start Pending
|
2
|
|
Stop Pending
|
3
|
|
Running
|
4
|
|
Continue Pending
|
5
|
|
Pause Pending
|
6
|
|
Paused
|
7
|
Table 6.4 Values available for Service startup Type
|
Start Type
|
Value
|
|---|
|
Auto Start
|
2
|
|
Manual
|
3
|
|
Disabled
|
4
|
|
Unknown state/startup type
|
-1
|
To create an internal service monitoring rule
-
Create an event processing rule that matches Microsoft Operations Manager event ID 21207. Set parameter 5 of this rule to match the service name. Note that this is the service executable name, and not the service control manager display name.
-
On the Alerts tab, select the Enable state alert properties check box, and click Add.
-
Build the condition clause for the service using the parameter values. Use the following values:
AttributeVlaue(Parameter 10)=2
AND (AttributeVlaue(Parameter9)="1"
OR AttributeVlaue(Parameter 9)="3")
Note
The above formula does not raise an alert for services in a paused or stop pending state. Based on the potential values for your service, ensure that you add checks for paused, if paused is a valid scenario for alerts.