I would like to configure an alert that triggers when any Windows service on a monitored server is restarted. I'm not talking about executing an alert action to restart a service (though this alert would fire when that happens), but I need to know when and hopefully who restarts a Windows service. Would this be done as an Audit Event alert, or as an application alert based on a Windows event log monitor? What variable would be queried in the Trigger?
Thanks in advance for your help.
I'll let others weigh in on detecting the service restart, I didn't find anything.
You can track alert actions by viewing alert history. Here is dashboard I use (sorry I don't remember the post to give proper credit to the creator):
SELECT DISTINCT
ahv.Name 'Alert Name'
,last24.Qty 'Last 24 Hrs'
,lastseven.Qty 'Last 7 Days'
,lastthirty.Qty 'Last 30 Days'
FROM AlertHistoryView ahv
Left outer JOIN
(SELECT Name, COUNT(1) 'Qty'
FROM AlertHistoryView
WHERE
TimeStamp > (GetDate()-1)
AND EventTypeWord = 'Triggered'
GROUP BY Name) last24 ON ahv.Name = last24.Name
Left outer JOIN
(SELECT Name, COUNT(1) 'Qty'
FROM AlertHistoryView
WHERE
TimeStamp > (GetDate()-7)
AND EventTypeWord = 'Triggered'
GROUP BY Name) lastseven ON ahv.Name = lastseven.Name
JOIN
(SELECT Name, COUNT(1) 'Qty'
FROM AlertHistoryView
WHERE
TimeStamp > (GetDate()-30)
AND EventTypeWord = 'Triggered'
GROUP BY Name) lastthirty ON ahv.Name = lastthirty.Name
ORDER BY lastthirty.Qty desc
