Application Monitor - svchost?

I am looking to monitor some standard windows services such as Internet Authentication Services (IAS) using Application monitor. The trouble is that Application monitor doesn't know anything about services, just processes. Most of the time you can make the linkage but in this case the service for IAS is "svchost.exe -k netsvcs".

Anyone who has ever looked at their task manager knows that there are plenty of "svchost.exe" processes running. How can I use Application Monitor to watch/alert/notify me when Internet Authentication Services stops?

Find more posts tagged with

Accepted answers

All comments

mfinnigan

Seconded. I don't know if there is a fix for this, the problem is that Windows doesn't present the underlying service name this way.

Mithrilhall

It doesn't sound like it would be to hard.

While I'm not familiar with the Application Monitor (I'll have to download and install it) it sounds possible with vbscript and WMI or another scripting language (PHP is my choice).

Vieregg

A few months ago, I wrote to SolarWinds:
I would like to monitor one of our web servers. The service is called w3svc. This service has a process called svchost. Using tasklist /svc, I was able to retrieve the PID for the w3svc service. However, when marking this specific process in the Application Monitor, all svchost processes are marked. Is there a way to select and monitor only one process even if the executable is used more often?

Here is the answer:
Thank you for contacting SolarWinds.Net. There is not currently a way to specify the process like you are trying to do. THe program does not know how to tell the difference between the two. I will forward your request to our Development Team.

iunderwo

For grins, I ran a MIB walk on one of the systems I manage, looking to find out where the process information is stored.

Interestingly enough, it looks as if the App Monitor is just using the names as part of the hrSWRunName in the HOST-RESOURCES-MIB. On the plus side, Windows does report any parameters and the startup directory as hrSWRunPath and hrSWRunParameters. It'll be nice to see these kinds of things included.

// Ian Underwood - Network Engineering
// Boston Stock Exchange