Is there any possibility to monitor windows services and schedulers using any azure service?

Question

Hello,

Is there any possibility to monitor windows services and schedulers using any azure service and send the alerts if it is stopped / restarted / started ?

If yes, how do you configure ?

If it is not possible, is there any other tool available in marketplace to do the same ?

Thanks,

Govinda

Answer 1

Hi,

Firstly, make sure the VM is onboarded to Azure monitor, and that you are capturing Events into the log analytics workspace.

Please see the guide here to onboard, I would recommend the AMA agent, as this is going to replace the older MMA agent: https://learn.microsoft.com/en-us/azure/azure-monitor/vm/monitor-virtual-machine-agent

After the VMs are onboarded, it's a case of creating the alert rules based off KQL queries, there is a good guide here: https://www.terminalworks.com/blog/post/2022/01/09/monitor-windows-services-using-azure-monitor-and-generate-an-email-alert#:~:text=Monitor%20the%20service%20status%201%20Find%20the%20Service,and%20run%20the%20query%20to%20see%20the%20results.

This will enable you to trigger alerts based on a service stopping etc

Hope this helps

Answer 2

@Govinda Roul , To add on to Richard's point, the scheduler run related history is available in the following Event Log (in Event viewer of Windows):

Applications and Services Logs / Microsoft / Windows / TaskScheduler / Operational

This logging is disabled by default, which can be enabled by right-click --> Enable Log.

Once the logs have been enabled, identify the event of interest and use the steps mentioned in the following article to collect these events in Log Analytics workspace- Collect events and performance counters from virtual machines with Azure Monitor Agent.

The steps above will only collect the events of interest based on the XPATh query used for creating the data collection rule (see this link for details about these terms - Collect events and performance counters from virtual machines with Azure Monitor Agent. ) For generating alert, a Log based alert rule will have to be created. The detailed steps are mentioned here - Create a new alert rule. The Event table in LA workspace would contain the events collected from the VM, and this table can be used for generating the query.

Hope this helps.

If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.