Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

SolarWinds SAM Monitor Multiple Window Services.

We have an application with over 2 dozen Windows services. We need to send an alert if any of these services go down. We don’t want to restart them because we need to investigate when the service(s) stopped.

I have been testing with SQL server since it has only 4-5 services running at a time. I have test Application Monitor Template with 3 of the SQL services listed. They are for SQL Server Service, SQL Server Agent service and SQL VSS Writer Service.

I made an alert the uses this component so send an alert when any of these 3 SQL services stops. I don’t get any alerts when stopping any of these 3 services.

I have also tried making a component for each of these SQL services and an alert for each of these 2 SQL services and they work normally. However, I am dealing with over 2 dozen services to monitor.

Do I have to make one application monitor template AND an alert for each of the 2 dozen services. Could I get by with either 1 component monitor with multiple alerts or 1 alert with multiple application monitor templates.

Thanks in advance.

Find more posts tagged with

Accepted answers

All comments

SteveK

So there are a couple things to unpack here.

So you can have multiple components (all the same with Windows Service Monitor or Mixed with multiple different component types, go as crazy with them as you would like) and there are a 2 main approaches to alerting on these that I'm aware of.

To make your life alot easier, I definitly recommend renaming the component so everything doesn't say "Windows Service Monitor." Simple click the check box and click the Rename button at the top of the table. That way things look alot cleaner, you can build better alerts and dashboards.

So now to the question on why you are not receiving the alert when down. There are a couple different things that could be at play but ultimately it depends on how you have your component configured and your alert configured. Under the component, what do you have set for "Status when process is not running"

You have the option for "Down" or "Not Running." You would need to make sure that this is lined up with the component status in the alert. You could technically do "not equal to up" but I find those get way too chatty.

To be able to fully break it down, I would need to see a screen shot of the component and your alert scope and trigger condition.

I'm personally not the biggest fan of creating unique alerts per application and/or component. So in my environment I have built out custom properties to control the alerts. Then all SAM monitors in my environment trip off of those. Essentially I give our teams the options for:

Do you want to alert off of component or application? (Drop down with Component or Application)
How long in the negative state till the alert trips? (Drop down with a couple timing options)
What should happen when the monitor is down or critical? (couple selections for alert actions like console, email, email/page)
What should happen when the monitor is in a warning state? (same as above)
Do you want the service to attempt an automated restart? (True/False)
Provide a list of email addresses for the teams [semicolon seperated list] (Text box)

Milage of course will vary depending the size of your environment and the amount of teams that are able to build monitors and alerts.

This way I was able to build out a handful of alerts based on the matrix. Given you have some redudant alerts with minor deviations for the time, but it seems to work pretty well in our environment. You can also populate the email address in the alert trigger and resolve actions with the custom property value. That way I did not have to create unique alerts per team.

adam.beedell

"Do I have to make one application monitor template AND an alert for each of the 2 dozen services. Could I get by with either 1 component monitor with multiple alerts or 1 alert with multiple application monitor templates."

No, yes, yes (in that order)

Did you poll them between when you stopped the service and when the alert wasnt recieved? If no, just that. If yes, either the component or the alert is broke. Your design otherwise is fine.

adam.beedell

(2 dozen is like no big deal, you can have like 1k applications handled with one alert no problem)
(Not a limit, but as that #applications grows it's had to maintain them under a single alert, possible though)

ballal

Thank you for your help in this matter. I renamed the components in the “Test SQL Services” template. I assigned the template to my test server.

Trigger condition has the component status as down – which is what is configured for the component in the “Test SQL Services” Template. The component ID of the Test SQL Services template is 264.

The alerts worked successfully when I stopped the SQL services for a while. After a while, the alert stopped working when I stopped the SQL services.

When stopping the services, I do get warning in the event log for the SQL Test Services template, but I don’t get the alerts from the SQL services alert itself.

SteveK

I think the component id is going to be your problem on that one. I want to say 264 is the template id, and each component would receive a new component id whenever its applied, so not really scalable.

You would probably want something like:

If you rename the monitor when its applied to the node, then you would need to update the scope. I always try to stick with the consistant items (Like an application monitor name) in the scope action and then your trigger action is the specific variable you are looking for. You could also do something with the component name instead, but then you are listing off alot more items.

bobmarley

I'm with @SteveK on his suggestions. Giving each Component a unique name will make your life a lot easier later when you want to start setting up alerts. I typically go with alerting off Component as it is the most granular of the two and sometimes mixing Application and Component variables in you alert or report variables gives mixed results.

ballal

I followed your suggestion and named the components in the template for the SQL services. I then created a new alert using the steps you detailed above. I tested it by stopping services and did get the alerts. Thank you all for your help in this matter.