This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Monitor or report on dashboard when a service is restarted

martian_monster over 3 years ago

I created a custom SAM templates to monitor various Sterling Integrator services that we use and setup an alert to go out when any of these services are down or report unknown which works great and like it should.

On Sunday mornings we have a PowerShell script that is launched via the task manager and restarts these services. The services are restarted very quickly so they do register as down in Solarwinds which is great.

Is there anyway to report/monitor/dashboard that these services were restarted? Ideally if I could add something to the dashboard to the Sterling Integrator team uses that would be ideal but not sure where to start on this.

Thanks, -Dave

Top Replies

shuth over 3 years ago in reply to shuth +1

A quick example. I monitored Event ID 7036 with a filter for "Print Spooler". It detected the stop/start events when I stopped/started the Print Spooler service. KMSigma.SWI wrote an event log report here…

Parents

0 shuth over 3 years ago

You could potentially add another monitor to SAM that uses the PowerShell component monitor or the Windows Event log monitor and show the event log message with the service stopped/started events.
The component monitor could be set to not go warning/critical/down so it could be an informational monitor. Then set up a custom table or write a custom SWQL query to show the last X event log messages from that component.
The Windows Event Log component monitor is probably the easier of the two to configure and it is native to SAM. You'd have to write your own PowerShell script to check the event log (or see if someone has written one somewhere).
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 shuth over 3 years ago

You could potentially add another monitor to SAM that uses the PowerShell component monitor or the Windows Event log monitor and show the event log message with the service stopped/started events.
The component monitor could be set to not go warning/critical/down so it could be an informational monitor. Then set up a custom table or write a custom SWQL query to show the last X event log messages from that component.
The Windows Event Log component monitor is probably the easier of the two to configure and it is native to SAM. You'd have to write your own PowerShell script to check the event log (or see if someone has written one somewhere).
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 shuth over 3 years ago in reply to shuth

A quick example. I monitored Event ID 7036 with a filter for "Print Spooler". It detected the stop/start events when I stopped/started the Print Spooler service.
KMSigma.SWI wrote an event log report here that I modified to only show that application. This could be placed on your summary dashboard as a custom table. Otherwise you could grab the SWQL query inside the report and use a custom query resource.
https://thwack.solarwinds.com/t5/NPM-Documents/Windows-Event-Logs-Report/ta-p/527625
Cancel
Vote Up +1 Vote Down

Cancel