SCOM Basics: Creating a Service Monitor with Automatic Recovery

I’ve decided to write a series of articles covering some of the tasks that could be helpful to the newer Operations Manager administrators.

This article will cover how to create a custom service monitor and how to implement an automatic service restart action associated with that service. In this example we will use the Print Spooler service.

Creating a custom service monitor:

First go to the authoring node of your console, you will see a section called Management Pack Templates, this is where we will create our custom service monitor.

go to auth A

Right click on Windows Service and select Add Monitoring Wizard.

add monitoring

On the first page of the wizard select windows service and click next.

windows service

Give your monitor a name and select the management pack that will be used to save it, you can also create a new management pack if required without leaving the wizard by clicking the New button to the right of the drop-down. Click next.

monitor name

On this screen we need to provide the name of the service to be monitored. Targeting a group will also limit the service discovery to only the grouped service, this prevents unnecessary load on servers that do not have the service. Tick Monitor only automatic services only if the service has automatic start.

service details blank

Clicking the  “…” button will open the below window allowing you to search for the required service. You can connect to any server using the “…” button next to Computer name.

Select the service and press OK.

select service

Once the service details are populated click next.

service details filled out

If you need to monitor performance of the service such as memory or CPU utilisation you can configure that here. If it’s not required just click next.

perf monitoring

The wizard will now display a final summary for your service monitor. Check everything is correct and click create.

final summary

Creating an automatic start service recovery:

Once your monitor has been created, right click on the service, select View Management Pack Objects and then Monitors.

recovery properties

On the monitors page expend the nodes until you find Service Running State, right click on the one that is listed in the same management pack from earlier and choose properties.

recovery properties 2

In the monitor properties click on the Diagnotic and Recovery tab, click Add under Configure recovery tasks and then select Recovery for critical health state.

add recovery action button

Choose Run Command. Click next.

run command

Give the recovery action a name and tick Recalculate monitor state after recovery finishes. Click Next.

recovery name

In order to start the service we will use the Net Start command, in full path to file enter the complete path c:\windows\System32\net.exe, next fill in the parameters field, begin with Start followed by the name of your service, in this case Start Spooler.

Note: If the service name contains spaces it is important to enclose the service name in quotes. For example “NetBackup Client Service”

recovery net start

Click create and close the monitor properties.

And there you have it, a custom service monitor with an automatic recovery action.





9 thoughts on “SCOM Basics: Creating a Service Monitor with Automatic Recovery

  1. Don


    Some services require a username and a password, how do we get around automating the service to start in scom.

    1. Warren Kahn Post author

      Hi Don,
      The credentials should be part of the service configuration, would you be willing to share an example?
      Even if a service uses a username / password to run it should still be able to start and stop using the NET command.

  2. Gregg

    How do we get the Diagnostic/Recovery data into the alert description? For example, the print spooler stops, alert fires, recovery initiates and the service can’t start for whatever reason (in this example let’s say the account used to start the service is locked). Is there a way to get this error into the alert description? You can see it in health explorer but we need the failure reason to show up in the alert description…


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.