Monitoring issue with removed Windows auto-start services

[JeanBlanc]

Hi everyone,

I’m running into an issue with the OS Services monitoring on Windows.
I’ve set up an alert to watch auto-start services so that I get notified whenever one is not in a running state.

The problem is:
👉 When an application is uninstalled (and the associated service is removed from the system), Dynatrace still keeps raising a problem, reporting that the service is missing / not running.

Has anyone faced this situation before?
Do you know if there is a recommended way to handle or automatically clean up services that are no longer present on the host?

Thanks in advance for your help!

[AntonPineiro]

Hi,

Do you know scope where that software must be installed and which not?

Best regards

[JeanBlanc]

Hi @AntonPineiro,

Thanks for your reply.
In this case, it was related to Kaspersky Security. The service was monitored by Dynatrace as long as the software was installed.

The challenge is that once the software was uninstalled from the host, the service obviously disappeared, but Dynatrace kept the monitoring configuration and started raising problems because it could no longer find the service.

I don’t really have a predefined scope of which hosts must have Kaspersky installed and which not. My main concern is how to prevent Dynatrace from continuously alerting on services that no longer exist after an uninstall.

Is there a recommended way to automatically clean up or disable the monitoring of services that are removed from a host?

Best regards

[AntonPineiro]

Hi,

My idea would be:

• Adding host metadata filters in the global rule.
• Disable global rule and apply host group or host level rule.

For both you need to define scope about which hosts will have that monitoring. You can have different approaches, or scripting or Puppet / Ansible or Workflows but target would be enable that OS service only in those hosts which software must be installed.

Best regards

[Mizső]

Hi @JeanBlanc 

We have the same isues also. Not so nince solution, but useful: 😉

Best regards,

János