RE: [msmom] RE: SCOM 2012 R2 Service Monitoring

[Henrik Andersen]

And it's start mode is "Automatic' and not "Automatic (delayed start)'? /Henrik -------- Oprindelig meddelelse -------- Fra: "Cooper, Karen A." <kcoo...@mitre.org> Dato: 11/01/2016 18.48 (GMT+01:00) Til: ms...@lists.myitforum.com Cc: "Cooper, Karen A." <kcoo...@mitre.org> Emne: [msmom] RE: SCOM 2012 R2 Service Monitoring Hi, I have seen the same thing the past. A service was in a “starting” state and we didn’t receive an alert on it.     Thanks Karen       Karen Cooper ISIS Senior Ops Sys Prgmr/Analyst The Mitre Corporation (781) 271-3280 kcoo...@mitre.org   From: listsadmin@lists.myitforum.com [mailto:listsadmin@lists.myitforum.com] On Behalf Of Kevin Holman Sent: Monday, January 11, 2016 12:20 PM To: ms...@lists.myitforum.com Subject: [msmom] RE: SCOM 2012 R2 Service Monitoring   No that is not normal… and dubious.   Service monitors in SCOM use the Microsoft.Windows.CheckNTServiceStateMonitorType from the Microsoft.Windows.Library.  You can see this if you open one of your own MP’s.   The Microsoft.Windows.CheckNTServiceStateMonitorType uses a couple native module datasources and a condition detection _expression_:   Microsoft.Windows.Win32ServiceInformationProvider Microsoft.Windows.Win32ServiceInformationProbe   The _expression_ is a bit complicated, but essentially it boils down to…. we detect a “ServiceNotRunning” condition when the following criteria are met:   1.  StartMode of the Service Equal 2 (Automatic)    AND    State NotEqual 4  (Running)   OR   2.  [CheckStartuptype = false (via override – default is true)] AND [StartMode NotEqual 2 (Automatic)]   AND  [State NotEqual 4  (Running)]     You can get these values from:  https://msdn.microsoft.com/en-us/library/ee809321.aspx   “Starting” = “Start pending” = a state of “2”.   As you can see – that would trigger the monitor.  We do not look for “state = stopped”.  We look for “state NOT Equal Running”                       <ConditionDetection ID="ServiceNotRunning" TypeID="System!System.ExpressionFilter">               <_expression_>                 <And>                   <_expression_>                     <Or>                       <_expression_>                         <SimpleExpression>                           <ValueExpression>                             <XPathQuery Type="Integer">Property[@Name='StartMode']</XPathQuery>                           </ValueExpression>                           <Operator>Equal</Operator>                           <ValueExpression>                             <Value Type="Integer">2</Value>                           </ValueExpression>                         </SimpleExpression>                       </_expression_>                       <_expression_>                         <And>                           <_expression_>                             <SimpleExpression>                               <ValueExpression>                                 <Value Type="String">$Config/CheckStartupType$</Value>                               </ValueExpression>                               <Operator>Equal</Operator>                               <ValueExpression>                                 <Value Type="String">false</Value>                               </ValueExpression>                             </SimpleExpression>                           </_expression_>                           <_expression_>                             <SimpleExpression>                               <ValueExpression>                                 <XPathQuery Type="Integer">Property[@Name='StartMode']</XPathQuery>                               </ValueExpression>                               <Operator>NotEqual</Operator>                               <ValueExpression>                                 <Value Type="Integer">2</Value>                               </ValueExpression>                             </SimpleExpression>                           </_expression_>                         </And>                       </_expression_>                     </Or>                   </_expression_>                   <_expression_>                     <SimpleExpression>                       <ValueExpression>                         <XPathQuery Type="Integer">Property[@Name='State']</XPathQuery>                       </ValueExpression>                       <Operator>NotEqual</Operator>                       <ValueExpression>                         <Value Type="Integer">4</Value>                       </ValueExpression>                     </SimpleExpression>                   </_expression_>                 </And>               </_expression_>               <SuppressionSettings>                 <MatchCount>2</MatchCount>               </SuppressionSettings>             </ConditionDetection>         From: listsadmin@lists.myitforum.com [mailto:listsadmin@lists.myitforum.com] On Behalf Of Sven Wells Sent: Monday, January 11, 2016 10:30 AM To: ms...@lists.myitforum.com Subject: [msmom] SCOM 2012 R2 Service Monitoring   Hello,   We recently ran into an issue whereby a Windows Service monitor did not produce an alert while the windows service was ‘stuck’ in a “Starting” status.  Not until the windows service actually “Stopped” did SCOM produce an alert.   Is this normal SCOM 2012 R2 monitoring behavior, and if so, can we change it to alert on any service status other than “Started”?   Thanks, Sven   Sven Wells PRINCIPAL SYSTEM ADMINISTRATOR IT Infrastructure TIP – Technology, Innovation and Performance   PPD Wilmington NC HQ   Phone +1 910 558 6870 sven.we...@ppdi.com www.ppdi.com   PPD LSS Yellow Belt   This email transmission and any documents, files or previous email messages attached to it may contain information that is confidential or legally privileged. If you are not the intended recipient or a person responsible for delivering this transmission to the intended recipient, you are hereby notified that you must not read this transmission and that any disclosure, copying, printing, distribution or use of this transmission is strictly prohibited. If you have received this transmission in error, please immediately notify the sender by telephone or return email and delete the original transmission and its attachments without reading or saving in any manner.