Kaseya Community

Auto monitor services

  • Is there any way to set up a monitor that will monitor ALL services set to AUTO START, and be notified whenever a service is stopped that is set that way?

    It doesn't make sense to have to add every service to a monitor set when we should just be notified when ANY one has stopped that should be running. Most other platforms provide this capability.

    Legacy Forum Name: Auto monitor services,
    Legacy Posted By Username: Interprom
  • Yes, monitor your event logs for service control entries, and alert on the ones you want to see.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: rdwilkerson
  • Isn't that the same thing? I just want Kaseya to alert if ANY service that's set to autostart is in a stopped state. I don't want to have to tell it every single service thats running on every single machine.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: Interprom
  • You can use the *All when checking the service. First you will need to run update list by scan on the monitoring tab. Then apply the monitoring set. That will monitor all Automatic services.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: bill.goldin
  • We'd like to start using this for monitoring all services as well. We found that some machines had services like the SysmonLog / Performance Logs and Alerts that is normally set for Automatic start but turned off. Is there any way to ignore/supress alerts for this when using *ALL ?

    Thanks
    DJ

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: donjjones
  • Search the scripts forum for KASM, the script will scan a machine for all auto-start services then export to an XML file on your K server. You can import the XML file as a monitor set. It works great, we use it on all our servers.

    Once you import the XML file as a monitor set you can go deleted the Sysmonlog and ATI and any other services you don't want monitored.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: cnwicsurrett
  • bill.goldin
    You can use the *All when checking the service. First you will need to run update list by scan on the monitoring tab. Then apply the monitoring set. That will monitor all Automatic services.


    this was so much easier then KASM - thank you.. Question- will using this remove services from the set if a service is removed from the machine? This is where KASM fails.. Also with KASM - it picks up services that just seem to bounce and you have to remove them..

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: pborginis
  • I tried this myself and when I created a monitor set that monitors services for *ALL I get the following alarm:

    Message: Monitoring generated Service ALARM at 11:58:22 am 13-Jul-09 on wserver.managed.sla3.kptech

    SNMP Device: N/A
    Monitor Set: KPT-All Services
    Type: Service
    Log Object Name: ntrtscan
    Agent Alarm Time: 11:58:22 am 13-Jul-09
    Event Time: 2:28:22 am 13-Jul-09 UTC
    Log Value: Service Does Not Exist
    Alarm Operator: N/A
    Alarm Threshold: N/A
    Alarm Duration: N/A
    Ticket ID: no ticket assigned

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: djmundy
  • We've currently got a montior set for each server, containing a handpicked list of services to monitor on that server. I really just want a list of the services with a grid of tickboxes so I can say what is to happen for each service (eg. ignore if not present;alert if added;alert if removed;alert if stopped;Only alert if stopped and if restart attempts have failed) .. and then to be able to apply this to all servers.

    Legacy Forum Name: Monitor Sets,
    Legacy Posted By Username: wodger
  • Has there been any update on any of this? I am in the same boat.

  • Bump. Still looking for something that can do this.

  • Since you've resurrected this old thread, I'll throw in my $0.02...

    Monitoring every service because it is set to auto start is a particularly bad idea unless you enjoy having your VSA virtually swimming in alerts. Disabling this method of alerting was one of the first things I did when coming on board about 3 years ago. This, combined with threshold adjustments of some monitors, elimination of inappropriate monitors, and using Service Desk to auto-remediate many alerts resulted in a drop in tickets by more than 62%. We now have an environment with over 3000 agents being monitored and no more than 3 engineers on help desk at any time. We also have a level of automation that insures that we don't miss alerts from missing or mis-applied monitor sets. Here's the general idea of what we deployed:

    1. Create baseline service monitor sets for servers and workstations. These two monitors apply to all workstations or servers and represent the services that are RUNNING (not just auto-start) when a freshly built system is reviewed. Many auto-start services start & initialize, then stop and restart on demand, and monitors that restart these services simply waste their time and the system's resources. Also, many Manual start services are started by other auto-start services, and will not be monitored if you just look at auto-start status.
    2. Create individual monitor sets for additional services needed by system roles, features, and applications.
    3. Develop a method to detect when these roles, features, and applications are present.
    4. Use the detection method above to apply System Policies to assign the appropriate monitor sets.

    Our RMM Suite employs a daily audit process that I developed. When it detects a new role, feature, or application suite, the appropriate monitor set is applied within 5 minutes of detection. This assures that all important services and applications are monitored without manual intervention. Conversely, when a role, feature, or application is removed, the monitor is also removed within minutes of discovering that it is gone. THis minimizes the period when false alerts can occur. When we do get such an alert and the engineer determines that the application was removed, they simply run the audit process and the monitors are removed automatically. Our engineers never manually apply monitor sets of any kind except for development and testing.

    The role/feature/application audit process uses a configuration file, so adding new applications is a breeze. Once the detection is built, a corresponding monitor set is developed and tested. After validating it, the manual link to the monitor is removed and a policy defined to apply it based on the detection. From that point, all future detections will apply the monitor set automatically. In all, it takes about an hour to build a new detection/monitor/policy set and verify it.

    You can check out the Kaseya Automation Exchange or the mspbuilder.com web site for more information about the RMM Suite, as well as several blog articles on best practices for monitoring and other Kaseya automation processes.

    Glenn

  • Have you looked at this yet

    mspassist.com/.../plugin-module

    In particular the "MSP Assist Kaseya ‘Plugin’"and the 2 video clips