Monitoring Splunk

monitoring windows services

wingfieldj
Explorer

how do you monitor a windows server service that is set to start at boot time and flag it if it stops or did not start? For instance monitoring the MSExchangeFrontEndTransport service every 20 minutes and alert if it is not running.

Tags (1)
0 Karma

sandeepmakkena
Contributor

Here is are a couple of ways you can do it.

https://answers.splunk.com/answers/7193/easy-way-to-check-if-a-windows-service-is-running.html
https://answers.splunk.com/answers/7193/easy-way-to-check-if-a-windows-service-is-running.html

If you are getting through logs, you can do it by using transaction command or other commands to check for a string service_start after service_stop is found, if not you can generate an alert.

I hope this helps, thanks!

0 Karma

sandeepmakkena
Contributor

If this is helpful, accept the answer, please

0 Karma

sandeepmakkena
Contributor

How are you getting those events into Splunk?

0 Karma

wingfieldj
Explorer

I do not think i have the input yet. i am hoping that the Splunk add-on for MS Windows will help with this.

0 Karma

patterc
Path Finder

how'd it work out?

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...