# Examples of OS service monitoring best practices **URL:** \ **Category:** Open Q&A\ **Tags:** windows, linux, hosts-classic, best-practices\ **Created:** [March 28, 2024, 2:09pm UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902 "2024-03-28T14:09:30Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![mizso74](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@mizso74](https://community.dynatrace.com/u/mizso74)\ **Post date:** [March 28, 2024, 2:09pm UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/1 "2024-03-28T14:09:30Z")
Hi Folks, Do you have any good examples for Linux and Windows OS service monitoring? I use only the default embedded Linux and Windows rules for failed autosart processes. ![Mizs_0-1711634945236.png](https://global.discourse-cdn.com/dynatrace/original/3X/3/0/3000a9d928b115e1303abe7c622607f3c50e24b6.png) Do you have any usecases which can be useful for others? Thanks in advance for your help. Best regards, Mizső ---
**Author:** ![Mohamed\_Hamdy](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@Mohamed\_Hamdy](https://community.dynatrace.com/u/Mohamed_Hamdy)\ **Post date:** [March 28, 2024, 6:13pm UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/2 "2024-03-28T18:13:34Z")
Hi [@Mizső](https://community.dynatrace.com/user/47783), I have multiple use cases for OS service monitoring, especially for Windows OS, and one of the important use cases is related to the MSSQL service monitoring on multiple servers, which in my case should be up and running all the time. so I have configured it for the MSSQL services with the alerting condition if the service status is not in a running state same as the following screenshot ![Mohamed_Hamdy_1-1711649371086.png](https://global.discourse-cdn.com/dynatrace/original/3X/e/8/e805c090b1afb15ab93bebc93dc298e0b6c8b0c0.png) also, I have added all configured OS services in a dashboard using the below query in Data Explorer with Honeycomb and enabled show labels to get the availability percentage, hostname, and service name. Note: you can change the status based on the configured status in your case (builtin:osservice.availability:filter(prefix(“dt.entity.os:service”,CUSTOM\_DEVICE-)):filter(or(eq(“dt.osservice.status”,running),eq(“dt.osservice.status”,active))):sum:auto:sort(value(sum,descending)):splitBy(“dt.entity.host”,“dt.entity.os:service”)/builtin:osservice.availability:filter(prefix(“dt.entity.os:service”,CUSTOM\_DEVICE-)):sum:auto:sort(value(sum, descending)):splitBy(“dt.entity.host”,“dt.entity.os:service”)\*100):setUnit(Percent):splitBy(“dt.entity.host”,“dt.entity.os:service”):sort(value(auto,ascending)):limit(100) Best regards, Mohamed ---
**Author:** ![mizso74](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@mizso74](https://community.dynatrace.com/u/mizso74)\ **Post date:** [March 28, 2024, 10:24pm UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/3 "2024-03-28T22:24:16Z")
Hi [@Mohamed\_Hamdy](https://community.dynatrace.com/user/4007), Thanks very much for sharing it!!! Best regards, Mizső ---
**Author:** ![sujit\_k\_singh](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@sujit\_k\_singh](https://community.dynatrace.com/u/sujit_k_singh)\ **Post date:** [March 29, 2024, 12:43am UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/4 "2024-03-29T00:43:07Z")
[@Mohamed\_Hamdy](https://community.dynatrace.com/user/4007) Thanks for providing this use case as well as query. ---
**Author:** ![Yosi\_Neuman](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/yosi_neuman/32/9845_2.png) [@Yosi\_Neuman](https://community.dynatrace.com/u/Yosi_Neuman)\ **Post date:** [March 30, 2024, 9:33am UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/5 "2024-03-30T09:33:26Z")
Hi [@Mizső](https://community.dynatrace.com/user/47783) , In out use case, customer asked to monitor all Windows OS services that are marked to be in running mode and are not running on server that is using OA in infrastructure mode. HTH Yos ---
**Author:** ![sia\_h](https://avatars.discourse-cdn.com/v4/letter/s/f14d63/32.png) [@sia\_h](https://community.dynatrace.com/u/sia_h)\ **Post date:** [March 31, 2024, 3:55pm UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/6 "2024-03-31T15:55:39Z")
Hi, Within some of my clients, we monitor essential services like backup software, antivirus software, and endpoint security software. Moreover, for Windows Servers we monitor services like SQL Server, IIS, and Windows Defender. | **Display Name** | **Service Name** | | --- | --- | | SQL Server | MSSQLSERVER | | Windows Defender | WinDefend | | IIS (Internet Information Services) | W3SVC | Sia ---
**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\ **Post date:** [September 30, 2024, 2:39pm UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/7 "2024-09-30T14:39:30Z")
Hi Mohamed How do we configure OS Service Monitoring alerts goes to specific workgroup. for all MSSQL OS Service monitoring to be sent to different assignment group. ---
**Author:** ![Mohamed\_Hamdy](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@Mohamed\_Hamdy](https://community.dynatrace.com/u/Mohamed_Hamdy)\ **Post date:** [October 1, 2024, 6:37am UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/8 "2024-10-01T06:37:21Z")
Hi [@sundarv1](https://community.dynatrace.com/user/74312) , You have a couple of options to consider. First, you can enable the alert option under OS services monitoring and specify the criteria and message. By default, this will generate a problem under availability. You can create an alerting profile and set up problem notifications for a specific group. The second option is to create a metric event for more customization, followed by an alerting profile and problem notification. Let me know if you need further assistance! ---
**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\ **Post date:** [October 1, 2024, 7:24am UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/9 "2024-10-01T07:24:02Z")
Mohammed - How do we create Metric event for Specific OS Service?. ---
**Author:** ![Mohamed\_Hamdy](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@Mohamed\_Hamdy](https://community.dynatrace.com/u/Mohamed_Hamdy)\ **Post date:** [October 1, 2024, 7:30am UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/10 "2024-10-01T07:30:18Z")
you can use Data Explorer then click on … and add a metric event, same as the screenshot below, i have used the below query as a sample in the global demo environment, of course, you can use different one ![Mohamed_Hamdy_0-1727767693054.png](https://global.discourse-cdn.com/dynatrace/original/2X/0/0b7b32927f5a8eaec9bdf096ab4f78f8a6c7af40.png) (builtin:osservice.availability:filter(and(or(eq(“dt.osservice.name”,“apl-easytravel”)))):filter(or(eq(“dt.osservice.status”,running),eq(“dt.osservice.status”,active))):sum:auto:sort(value(sum,descending)):splitBy(“dt.entity.host”,“dt.entity.os:service”)/builtin:osservice.availability:filter(and(or(eq(“dt.osservice.name”,“apl-easytravel”)))):sum:auto:sort(value(sum, descending)):splitBy(“dt.entity.host”,“dt.entity.os:service”)\*100):setUnit(Percent):splitBy(“dt.entity.host”,“dt.entity.os:service”):sort(value(auto,ascending)):limit(100) ---
**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\ **Post date:** [October 30, 2024, 8:19am UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/11 "2024-10-30T08:19:54Z")
Hi Mohammed if we create metric event, how to do exclude the OS services which we don’t want to monitor. Please suggest. ---
**Author:** ![Mohamed\_Hamdy](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@Mohamed\_Hamdy](https://community.dynatrace.com/u/Mohamed_Hamdy)\ **Post date:** [October 30, 2024, 8:38am UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/12 "2024-10-30T08:38:01Z")
Hi [@sundarv1](https://community.dynatrace.com/user/74312) , If I understand your question correctly, as long as you’ve created this metric using the metric selector for the OS services you need to cover, you don’t need to worry about the other OS services. if you are asking to switch of the os service monitor or enable/disable monitor or alert for the OS services you can do that directly from the os service monitoring settings as per the below screenshot ![Mohamed_Hamdy_0-1730277710982.png](https://global.discourse-cdn.com/dynatrace/original/2X/b/ba33471eb5dfd5b7dd83a58b9e60941b5e3304f3.png) ---
**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\ **Post date:** [October 30, 2024, 8:48am UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/13 "2024-10-30T08:48:42Z")
Hi Mohammed we need to create this metric selector, before that i want to check how do avoid other services which we don’t monitor. we have 50 services running in the server and we want to not be alert permanently if few services are not running ---
**Author:** ![Mohamed\_Hamdy](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@Mohamed\_Hamdy](https://community.dynatrace.com/u/Mohamed_Hamdy)\ **Post date:** [October 30, 2024, 1:02pm UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/14 "2024-10-30T13:02:38Z")
Hi [@sundarv1](https://community.dynatrace.com/user/74312) , just to get a clear understanding, you currently have 50 OS services configured for monitoring with Dynatrace. I assume you are using a single OS service monitor for all these services; is that correct? based on how it was configured, You can check this under Settings → Monitoring → OS Services Monitoring. or you can check under the host directly if it was configured under the host settings ![Mohamed_Hamdy_2-1730293299540.png](https://global.discourse-cdn.com/dynatrace/original/3X/b/0/b0513947eb852cacea7ecf2127a3592b70ca7d35.png) If you don’t need to monitor some of the other OS services, consider reconfiguring or creating a separate OS service monitor for those that require coverage only ---
**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\ **Post date:** [October 30, 2024, 1:17pm UTC](https://community.dynatrace.com/t/examples-of-os-service-monitoring-best-practices/44902/15 "2024-10-30T13:17:57Z")
currently we have done in the above way. only challenge if we do with this way, all the alerts are going to default profile and coming as availability event. we want to configure this metric event so this can be as resource event.