SCOM Monitoring a Service on two different servers and alert only when service is stopped in both servers

Question

Need help in Monitoring a Service on two different servers and alert only when service is stopped in both servers. Service will be running only on either of the server so monitoring in regular Windows Service Monitor will give false alerts. Can you help me on how can I setup this in SCOM.

I see about Aggregate and Dependency monitor, but I m able to get the clear idea. Pls help on this.

Answer 1

Hi,

You can do this without any custom code by combining a normal Windows Service monitor with a Dependency Rollup monitor on a group.

Goal: Healthy if the service is running on at least one of the two servers, and alert only when it is stopped on both.

1. Create a group for the two servers

1. Go to Authoring → Groups → Create a new group.
2. Add the two Windows Computer objects that host the service as explicit members.
3. Name it e.g. “<ServiceName> Nodes” and save it in a dedicated MP.

2. Create a Windows Service monitor (no alerting)

1. Go to Authoring → Monitors.
2. Add a Basic Service Monitor under Windows Services.
3. Target it to Windows Server Operating System (or similar).
4. In the Targeting step, choose “A specific group” and select the group you created, so the monitor only runs on those two servers.
5. Configure the service name as usual.
6. In the Alerting step, disable “Generate alerts for this monitor” – we want it to drive health only.

Now each of the two servers has a health state for that service, but they don’t create alerts themselves.

3. Create a Dependency Rollup monitor on the group

1. Create a Dependency Rollup Monitor and target it to the group (e.g. “<ServiceName> Nodes”).
2. In the configuration:
   • Choose the child class as Windows Server Operating System (or the class you used for the service monitor).
     • Relationship: group membership.
       • Child monitor: select your <ServiceName> – State Windows Service monitor.
       1. Set the rollup policy to “Best health state of any member”.
       2. Enable alerting on this dependency monitor and give it an appropriate name/description.

Behaviour:

• If the service is running on one server and stopped on the other, one child monitor is Healthy and one is Critical. With Best health state of any member, the group stays Healthy → no alert.
• Only when the service is stopped on both servers (both child monitors Critical) does the group go Critical and raise a single alert.

This avoids the false alerts you would get from monitoring each server independently, and still tells you when the service is down everywhere.

If you also need the servers themselves to remain green (no red health on the passive node), you can model this with a custom “business service” class plus dependency rollups, but for many scenarios the group + dependency monitor approach above is the simplest way to achieve the requirement.

  Best Regards

Stoyan Chalakov

"If my response was useful, please consider marking it as the answer. It keeps the forum clean, structured, and more helpful for everyone. Thank you for supporting the community."