Monitor and restart stopped Windows services in SAM

To automate the monitoring and restarting of stopped Windows services, you can assign a Windows Service Monitor to nodes and then set up an alert to restart services and send email.

Note the following details about creating alerts to restart stopped Windows services:

• The action to restart the service uses the credentials which the component is currently being monitored with.
• WMI requires administrator privileges on the target machine by default; permission issues can occur if the accounts have limitations.
  

  SolarWinds Support cannot assist with creating a least-privileged Windows user account or assigning permissions. Click here to learn about creating a non-administrator user for SAM polling.

• If polling the service via Windows agent, the agent runs under the context of the LocalSystem account on the target machine so it requires sufficient privileges to restart the service.
• The action to restart the service will only work with a component monitor-based alert. If the alert is set up as an "I want to alert on an application monitor" on the Trigger Condition tab, the restart service alert action will not function.

Click here to learn more about alerts, or watch a SolarWinds Lab Bits video, Automating Alert Trigger Actions.

Create the monitor

1. Click Settings > All Settings > SAM Settings > Component Monitor Wizard.
2. Select Windows Service Monitor, and then click Next.
3. Enter the IP address of the Windows node you want to monitor, or click Browse to select the node from a list.
4. Enter or select the appropriate credentials, choose a Platform type, and then click Next.
5. Select services to monitor and click Next.
6. Select component monitors and edit properties as necessary, and then click Next.
7. On the Add to Application Monitor or Template tab, type a name for the new template and click Next.
8. On the Assign to Nodes tab, select the desired nodes to monitor and click Next.
9. On the Confirm tab, click OK, Create.

Create an alert to restart stopped Windows services and then send an email

1. Click Alerts & Activity > Alerts.
2. On the All Active Alerts page, click Manage Alerts.
3. On the Manage Alerts page, click Add New Alert.
4. In the Add New Alert wizard, provide alert details on the Properties tab and click Next.
5. On the Properties tab, provide alert details.
6. On the Trigger Condition page:
   1. For "I want to alert on", select Component.
   2. Choose an alert scope.

   3. Configure a trigger condition as follows:

      1. Component > Component Type (Component Alerting Properties) > Is equal to > 9.

      2. Component > Component Availability (Component Alerting Properties) > Is equal to > Down.

      

      Configuring only these two conditions will allow for any Window service being monitored across all application templates. If you need to be more refined with your service restarts, consider adding additional items to limit the scope to a specific application template, specific nodes, etc.

   4. Click Next to advance to the Reset Condition tab.
7. Enter values on the Reset Condition and Time of Day tabs, as necessary.
8. On the Trigger Actions tab, add an action to send email.
   1. Click Add Action.
   2. Select Send an E-Mail / Page and click OK.
   3. Complete the e-mail info and click OK.
   4. Click OK.

9. On the Trigger Actions tab, add an action to restart the service:

   1. Click Add Action.
   2. Select Execute an External Program, and then select Configure Action.
   3. Provide a name for the action.

   4. Under Network path to external program, insert the following:

      C:\Program Files\SolarWinds\Orion\APMServiceControl.exe

      ${N=SwisEntity;M=ComponentAlert.ComponentID} -c=RESTART

   5. Click Add Action.

10. For the Reset Action tab, specify actions to complete when resetting the alert.

11. On the Summary tab, review the configuration and make any necessary changes.
12. Click Submit.

See also Create an alert for monitored components in SAM.