System Center Operations Manager 2019 - Authoring/Management Pack Templates/Process Monitoring - Computer Name

Question

Hi

I have a problem with setting up a process monitoring Monitor (unwanted processes running)
I've gone to Authoring/Management Pack Templates/Process Monitoring > Add monitoring Wizard
I've created an entry that looks for the spoolsv.exe process (Monitor only whether the process is running" against target group "All Windows Computers"
This successfully create multiple entries in my Active Alerts - one entry for each computer in my domain (as they all run the print spooler). Unfortunately it does not list the computer name in the alert and I can't see to add the computer name into the alert Description. or anywhere else.
I've tried things like the following

https://kevinholman.com/2015/02/20/can-alert-names-contain-dynamic-data/
https://kevinholman.com/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications/

None of these settings displays the Computer name - they just display {0} where the name ought to be.

Has anyone else implemented the "Process Monitoring" alert monitor and managed to get it to display the Computer Name?

Regards

Ken Z

Answer 1

Hi,

Print Spooler is a windows service. What's the purpose for the monitor? We disallow any computer to run the service, if found running, generate an alert? Or we need all the computers to have the service runing, is found stopped, generate an alert? Is there any chance for us to use the "Windows Service" monitor?

If the above does not meet our requirement, we may consider to create a monitor based on powershell script and generate an alert based on the result ("Running" or "Stopped")

 $api = New-Object -comObject "MOM.ScriptAPI"   
 $PropertyBag = $api.CreatePropertyBag()  
      
 $var1 = (get-service spooler).status.tostring()  
      
 $PropertyBag.AddValue("Status",$var1)  
 $PropertyBag  

Regards,

Alex
If the response is helpful, please click "Accept Answer" and upvote it.