Unit Monitor ‘Basic Service Monitor’ does not work correctly when monitoring a Service which is set to start manually

Update 29-10-2010: Got two comments from Vladimir Trigub based on this posting.

His first comment is to use the MP Authoring Console and not the SCOM R2 Console for creating Monitors like these. Even though I do know and recognize the power of the MP Authoring Console I also realize that many everyday users of SCOM find it a bit too complicated. Therefore I have used the regular SCOM R2 Console in this posting. Also because the issue came to be by using the SCOM R2 Console. His second comment is that the required override can be set through the same SCOM R2 Console. So no need to export the MP, edit it and import it again. I have updated this article accordingly. Thanks Vladimir for your comment and keeping me sharp!

Bumped into this issue yesterday. A customer of mine had made several Unit Monitors (the workhorse of SCOM Monitors) in order to monitor a service. Everything seemed to be just fine ONLY that the monitor reported to be Healthy on the targeted servers while the service was NOT running! That was really strange.

Since this customer has some good SCOM experience and the screenshots he sent showed nothing strange, I decided to built such a monitor in one of mine test environments. Since the customer had targeted a Service which was not set to start automatically, I selected a service which was set in the same manner. Also my test environment showed the same behavior: the Monitor showed up Healthy while the service on the targeted server wasn’t running!

So I took a deeper dive in order to get to the bottom of it. This blog posting will tell you all about that search and its outcome.

01 – The Situation
Lets say I want to build a Monitor which monitors the Application Management service on a particular server. As you can see this service is not running yet and is set to start Manual. I have chosen this particular service because it does not have an executable of its own. It uses the process svhost.exe with some additional switches. I have done this with a special reason but more about that later on.

I will build this Monitor in a quick & dirty way: I create the monitor, targeted at Windows Server 2003 Computer and set it by default disabled. Later on I enable it with an override, targeted at the particular server. A better way to go is to create a new Class and target that Monitor at that Class. But this posting is not about MP Authoring, so forgive me.

And:

And:

The Monitor is enabled with an override targeted at a Windows 2003 Server. When I open Health Explorer for that server this is shown:

But that is not true. Lets take a look at Services Manager on that server. The service is really not running. What is happening here?

02 – The Explanation
I searched the Internet and quickly I bumped into this website where this behavior was explained:

Sigh!

But wait! SCOM R2 has improved Management Pack Templates. Among them is the Windows Service Monitor Template to be found. Lets take a look at that one and check out whether this one will do the trick?

Hmm. Another snag!

:). That’s why I have chosen this particular service. For some reason this wizard does not work with services which do not use a unique executable. As stated before, the service Application Management uses the generic process svhost.exe with some special switches. So this wizard will not work in this particular situation.

However, suppose you have to monitor a service which is not set to run automatically AND this service uses a unique executable. Now this Wizard would do the trick because it has an additional option available which is not to be found in the GUI while creating a Unit Monitor (Basic Service Monitor):

Now you are about to say: ‘Duh! When I want to monitor a service which isn’t set to run automatically AND this service uses svchost.exe or something alike, this cannot be done by SCOM!’. But wait just a minute! By setting a simple and straightforward override all is OK again!

03 – The Workaround 
Select the newly created Monitor and set an override on Parameter Name Alert only if service startup type is automatic (set it to false), like this:
  
Save the override.

Lets check Health Explorer again:
 

Wow! That looks way much better! Lets start the service in order to check out the correct workings of this Monitor:

Nice!

So whenever you create a Basic Service Monitor in order to check the status of a Service which is not set to start automatically this is the way to go.