Generating an Alert after service being stopped n-times within certain time

Scenario:

The Windows NT Service of a buggy application crashes regularly and is restarted automatically with an Recovery Task.

You only want to receive an Alert if this happens n-times within a specified time.

Steps:

1. Create a Basic Service Monitor which does not generate an Alert.
2. Create a Recovery Task for the Basic Service Monitor in Step 1.
3. Create a Windows Event Repeated Event Detection Monitor.

 

Step 1. Create a Basic Service Monitor which does not generate an Alert

Just create a ‘normal’ Windows Service Monitor.

Step 2. Create a Recovery Task for the Basic Service Monitor in Step 1.

Change working directory to %windir%

Tip: On Windows 2000 servers there isn't being logged that a service is stopped in the System Eventlog. Create another Recovery Task which creates an Eventlog if the service is stopped. You can use the LOGEVENT tool in the Windows 2000 Server Reskit if you want.

Step 3. Create a Windows Event Repeated Event Detection Monitor.

Configure the EventID which shows that a service is being stopped. Or use your own created Windows NT EventID on a Windows 2000 server.

Configure the Repeat Settings for your environment.

Info from the OpsMgr Helpfile.

Enable the monitor with an Override for the correct computers.