Menu Close

How to discover and monitor a service with a wildcard for the service name

There are times when an application installs a Windows Service that uses inconsistent naming.  There might be a scenario where the Computer Name is inserted into the service name, or where random characters get generated in the service name.

I wrote about this previously here:  https://kevinholman.com/2011/01/20/how-to-monitor-a-service-with-unique-names-across-multiple-computers-using-a-wildcard/

 

Now, I have a Visual Studio fragment to make this even easier.   This fragment will use a WMI based discovery that supports a partial name match with a wildcard, to discover instances of your service name as a property.  Then it includes a monitor which uses this class property and monitors the discovered service name.

 

You can download the fragment library here:  https://gallery.technet.microsoft.com/SCOM-Management-Pack-VSAE-2c506737

You can see fragments in action here:  https://kevinholman.com/2019/07/15/advanced-mp-authoring-mpu-may-2019/

 

In this scenario, I am going to use a built in service that uses random data in the service name.

image

 

You can use Silect MP Author or Visual Studio with VSAE for fragments.   I’ll be using Visual Studio in this example.

Create a new MP:

image

 

Add an existing item, and choose my new fragment “Combo.Class.Discovery.ServiceMonitor.Wildcard.WMIQuery.mpx”

image

 

In this fragment, we will need to replace the following items:

##CompanyID##
##AppName##
##ServiceNameWildcard##
##UniqueID##

CompanyID and AppName are standard across all fragments. 

##ServiceNameWildcard## is what will go into the WMI query, that supports the operator for wildcards “%”.

In this example, since I want to discover and monitor any services that start with “UserDataSvc_”.  Therefore I will replace ServiceNameWildcard with “UserDataSvc_%”

image

 

For the UniqueID, this just needs to be something to keep this workflow unique, in case we want to reuse the fragment multiple times in the same MP.  Since this is my User Data Svc  service monitor, I will just use that.  (NO SPACES OR SPECIAL CHARACTERS ALLOWED)

image

 

That’s it!   Save it and Build it, and we are ready to deploy this MP.

 

If you look at Discovered Inventory, change target type to our new Demo App class view, you will begin to see new instances showing up:

image

image

 

Note the ServiceName property, with different names in each.  Also note they are monitored – because the built in service monitor in the fragment is enabled.

image

 

And we are generating good quality alerts:

image

8 Comments

  1. Peter Commander

    Kevin, once again you have put together an MP fragment that hits home! Cannot thank you for your work in this area, and for keeping us SCOM admins semi-sane.

    • Kevin Holman

      Thanks Peter! Knowing my work is helping others keeps me motivated. Appreciate you taking time to comment.

      • Peter Commander

        Kevin, one more thing: how does one alert on automatic startup services only (no need to alert on a manual or disabled start, not just disabled)? Similar to the checkbox in the console UI for windows services monitors. Thanks in advance.
        Peter C.

      • Peter Commander

        Kevin, I worked it out in the fragment to exclude the manual startup services by Copying/adding this code to the ConditionDetection section, Expression Section for “ServiceRunning” (Equal), and Expression Section for “ServiceNotRunning” (NotEqual), value=3:

        Property[@Name=’StartMode’]

        Equal

        3

        Copied for each wildcard condition within the MP, adding the condition test for startmode = 3. Again, a fantastic fragment, saves tons of time!

  2. Dmitry Kirushev

    Thanks , it’s great!
    Is it possible to detect multiple services with wild card in their names on the same server?

    Sample WMI query :
    Select Name from Win32_Service where Name like ‘e1c%’

    Query return this:
    Win32_Service.Name=”e1c2541″
    Win32_Service.Name=”e1c3541″
    Win32_Service.Name=”e1c4541″
    Win32_Service.Name=”e1c5541″
    Win32_Service.Name=”e1c6541″

    ?

  3. Michael Møller

    Thanks for another great article. I am using this fragment with another wmi query and it works. I would like to also add a task so that it is possible to start the service from console when alert is raised. Any chance for a fragment where that is included? I am struggling with parameters and how to be able to use parameters in a powershell script. Want to use a parameter for the servicename.

Leave a Reply

Your email address will not be published. Required fields are marked *