How to create ITSI KPI for windows service status?

ansif — Fri, 05 Jan 2018 05:35:30 GMT

For Windows service I created a search like below:

eventtype=hostmon_windows Type=Service host="*" (Name="ClusSvc" OR Name="MSExchangeADTopology" OR Name="MSExchangeAntispamUpdate" OR Name="MSExchangeCompliance" OR Name="MSExchangeDagMgmt" OR Name="MSExchangeDelivery" OR Name="MSExchangeDiagnostics" OR Name="MSExchangeEdgeSync" OR Name="MSExchangeFastSearch" OR Name="MSExchangeFrontEndTransport" OR Name="MSExchangeHM" OR Name="MSExchangeHMRecovery" OR Name="MSExchangeImap4" OR Name="MSExchangeIMAP4BE" OR Name="MSExchangeIS" OR Name="MSExchangeMailboxAssistants" OR Name="MSExchangeMailboxReplication" OR Name="MSExchangePop3" OR Name="MSExchangePOP3BE" OR Name="MSExchangeRepl" OR Name="MSExchangeRPC" OR Name="MSExchangeServiceHost" OR Name="MSExchangeSubmission" OR Name="MSExchangeThrottling" OR Name="MSExchangeTransport" OR Name="MSExchangeTransportLogSearch" OR Name="MSExchangeUM" OR Name="MSExchangeUMCR" OR Name="COMSysApp" OR Name="Dnscache" OR Name="gpsvc" OR Name="HostControllerService" OR Name="IISADMIN" OR Name="LanmanServer" OR Name="LanmanWorkstation" OR Name="lmhosts" OR Name="LSM" OR Name="MpsSvc" OR Name="MSDTC" OR Name="MSMQ" OR Name="NcbService" OR Name="Netlogon" OR Name="Netman" OR Name="NetMsmqActivator" OR Name="NetPipeActivator" OR Name="netprofm" OR Name="NetTcpActivator" OR Name="NetTcpPortSharing" OR Name="ProfSvc" OR Name="RpcEptMapper" OR Name="RpcSs" OR Name="SamSs" OR Name="SessionEnv" OR Name="TermService" OR Name="W32Time" OR Name="W3SVC" OR Name="WAS" OR Name="Wcmsvc" OR Name="Winmgmt" OR Name="WinRM" OR Name="wmiApSrv" OR Name="WMSVC") StartMode="*" State="Stopped"

Threshold field as "Name"

It works only if any of the service is in stopped state since no event returns if all services are running.

Any suggestion on how to create a KPI in such scenario?

Re: How to create ITSI KPI for windows service status?

svemuric — Fri, 09 Feb 2018 12:19:33 GMT

Try with KPI Base searches create each service Name as a event using eval and add each service event as a Add Metrics define thresholds for each metric

Re: How to create ITSI KPI for windows service status?

ansif — Fri, 09 Feb 2018 12:41:02 GMT

@svemuric : The issue has been fixed by creating KPI itself. Attaching KPI settings for others who requires:

Treat Gap in data as Normal.

Re: How to create ITSI KPI for windows service status?

KSinghK — Tue, 14 Jul 2020 14:06:34 GMT

@ansif this did not work for me. and I am running a pretty small search

Index=* Type=Service Name= *BES* host=* StartMode=* State=Stopped.

This works on normal search but when you add it to ITSI or create a KPi base search it stops working.

topic Re: How to create ITSI KPI for windows service status? in All Apps and Add-ons

How to create ITSI KPI for windows service status?

Re: How to create ITSI KPI for windows service status?

Re: How to create ITSI KPI for windows service status?

Re: How to create ITSI KPI for windows service status?