I'm curious if anyone knows if you are able to have a service monitor send a "clearing alert".
It is simple to set a service monitor to send an email. It will indicate that the service has stopped which is valuable so we can take a look at the machine. The service monitor is also set to attempt to restart the service and 99 out of 100 times the service starts and we dont get further alerts on that service.
What I'm hoping to figure out is for a 2nd email alert to be sent after the service is started up. We would then have confidence the issue is resolved and not need to check it out.
Any thoughts on something we could build into the monitor? A script that would check to see if the service was up and send that 2nd email?
How I expect Classic Monitor to function around Windows Services:
Monitor Set has a defined "Restart Attempt Count 3 and Threshold of 1 minute" - The Monitor Set will try and restart the service once a minute, if the service cannot be started, it will then fire the first alert stating "The monitored service has stopped and could not be restarted."
IF the monitor set is able to remediate the service, it will not trigger an ATSE (Alarm/Ticket/Script/Email) action. The only reference will be logged in the Agent > Agent Logs > Monitor Action Log, indicating the service was stopped and remediated by the Kaseya Agent. As the service has already been remediated no actions will trigger.
Monitor set has a no defined "Restart Attempt Count or Threshold" - The Monitor Set will not try and remediation actions and immediately trigger an alarm/ticket/script/email.
To get the desired behavior there are a few options:
~ KNMi will notify on the recovery of an alarm and the alarm of the service:
~ You could build the logic in an Agent Procedure to do these steps as the ATSE action associated the monitor set.
~ Setup an Event Log Set on the agents that will monitor when a service stops, here is an example snippet you should see in the event log: "service entered the stopped state." You could then trigger some sort of ATSE action from this notification.
System > Server Management > Configure > Enable auto close of alarms and tickets
This will send a second alert email if the endpoint exits the alarm state