I created a custom SAM templates to monitor various Sterling Integrator services that we use and setup an alert to go out when any of these services are down or report unknown which works great and like it should.
On Sunday mornings we have a PowerShell script that is launched via the task manager and restarts these services. The services are restarted very quickly so they do register as down in Solarwinds which is great.
Is there anyway to report/monitor/dashboard that these services were restarted? Ideally if I could add something to the dashboard to the Sterling Integrator team uses that would be ideal but not sure where to start on this.
You could potentially add another monitor to SAM that uses the PowerShell component monitor or the Windows Event log monitor and show the event log message with the service stopped/started events.
The component monitor could be set to not go warning/critical/down so it could be an informational monitor. Then set up a custom table or write a custom SWQL query to show the last X event log messages from that component.
The Windows Event Log component monitor is probably the easier of the two to configure and it is native to SAM. You'd have to write your own PowerShell script to check the event log (or see if someone has written one somewhere).
A quick example. I monitored Event ID 7036 with a filter for "Print Spooler". It detected the stop/start events when I stopped/started the Print Spooler service.
@KMSigma wrote an event log report here that I modified to only show that application. This could be placed on your summary dashboard as a custom table. Otherwise you could grab the SWQL query inside the report and use a custom query resource.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.