monitoring windows services

[wingfieldj]

how do you monitor a windows server service that is set to start at boot time and flag it if it stops or did not start? For instance monitoring the MSExchangeFrontEndTransport service every 20 minutes and alert if it is not running.

[sandeepmakkena]

Here is are a couple of ways you can do it.

https://answers.splunk.com/answers/7193/easy-way-to-check-if-a-windows-service-is-running.html
https://answers.splunk.com/answers/7193/easy-way-to-check-if-a-windows-service-is-running.html

If you are getting through logs, you can do it by using transaction command or other commands to check for a string service_start after service_stop is found, if not you can generate an alert.

I hope this helps, thanks!

[sandeepmakkena]

If this is helpful, accept the answer, please

[sandeepmakkena]

How are you getting those events into Splunk?

[wingfieldj]

I do not think i have the input yet. i am hoping that the Splunk add-on for MS Windows will help with this.

[patterc]

how'd it work out?