No that is not normal... and dubious. Service monitors in SCOM use the Microsoft.Windows.CheckNTServiceStateMonitorType from the Microsoft.Windows.Library. You can see this if you open one of your own MP's.
The Microsoft.Windows.CheckNTServiceStateMonitorType uses a couple native module datasources and a condition detection expression: Microsoft.Windows.Win32ServiceInformationProvider Microsoft.Windows.Win32ServiceInformationProbe The expression is a bit complicated, but essentially it boils down to.... we detect a "ServiceNotRunning" condition when the following criteria are met: 1. StartMode of the Service Equal 2 (Automatic) AND State NotEqual 4 (Running) OR 2. [CheckStartuptype = false (via override - default is true)] AND [StartMode NotEqual 2 (Automatic)] AND [State NotEqual 4 (Running)] You can get these values from: https://msdn.microsoft.com/en-us/library/ee809321.aspx "Starting" = "Start pending" = a state of "2". As you can see - that would trigger the monitor. We do not look for "state = stopped". We look for "state NOT Equal Running" <ConditionDetection ID="ServiceNotRunning" TypeID="System!System.ExpressionFilter"> <Expression> <And> <Expression> <Or> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="Integer">Property[@Name='StartMode']</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="Integer">2</Value> </ValueExpression> </SimpleExpression> </Expression> <Expression> <And> <Expression> <SimpleExpression> <ValueExpression> <Value Type="String">$Config/CheckStartupType$</Value> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="String">false</Value> </ValueExpression> </SimpleExpression> </Expression> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="Integer">Property[@Name='StartMode']</XPathQuery> </ValueExpression> <Operator>NotEqual</Operator> <ValueExpression> <Value Type="Integer">2</Value> </ValueExpression> </SimpleExpression> </Expression> </And> </Expression> </Or> </Expression> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="Integer">Property[@Name='State']</XPathQuery> </ValueExpression> <Operator>NotEqual</Operator> <ValueExpression> <Value Type="Integer">4</Value> </ValueExpression> </SimpleExpression> </Expression> </And> </Expression> <SuppressionSettings> <MatchCount>2</MatchCount> </SuppressionSettings> </ConditionDetection> From: [email protected] [mailto:[email protected]] On Behalf Of Sven Wells Sent: Monday, January 11, 2016 10:30 AM To: [email protected] Subject: [msmom] SCOM 2012 R2 Service Monitoring Hello, We recently ran into an issue whereby a Windows Service monitor did not produce an alert while the windows service was 'stuck' in a "Starting" status. Not until the windows service actually "Stopped" did SCOM produce an alert. Is this normal SCOM 2012 R2 monitoring behavior, and if so, can we change it to alert on any service status other than "Started"? Thanks, Sven Sven Wells PRINCIPAL SYSTEM ADMINISTRATOR IT Infrastructure TIP - Technology, Innovation and Performance PPD Wilmington NC HQ Phone +1 910 558 6870 [email protected]<mailto:[email protected]> www.ppdi.com<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.ppdi.com%2f&data=01%7c01%7ckevin.holman%40microsoft.com%7c9a0562aeed1d464a9f6c08d31aa4fb54%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=uRrosXS09wlVAWhT%2bKiebQs9lm10Jh63WY6jQNh52no%3d> PPD LSS Yellow Belt [cid:[email protected]] This email transmission and any documents, files or previous email messages attached to it may contain information that is confidential or legally privileged. If you are not the intended recipient or a person responsible for delivering this transmission to the intended recipient, you are hereby notified that you must not read this transmission and that any disclosure, copying, printing, distribution or use of this transmission is strictly prohibited. If you have received this transmission in error, please immediately notify the sender by telephone or return email and delete the original transmission and its attachments without reading or saving in any manner.
