Examples of OS service monitoring best practices

[Mizső]

Hi Folks,

Do you have any good examples for Linux and Windows OS service monitoring?

I use only the default embedded Linux and Windows rules for failed autosart processes.

Do you have any usecases which can be useful for others?

Thanks in advance for your help.

Best regards,

Mizső 

[Mohamed_Hamdy · Accepted solution]

Hi @Mizső,

I have multiple use cases for OS service monitoring, especially for Windows OS, and one of the important use cases is related to the MSSQL service monitoring on multiple servers, which in my case should be up and running all the time.

so I have configured it for the MSSQL services with the alerting condition if the service status is not in a running state same as the following screenshot

also, I have added all configured OS services in a dashboard using the below query in Data Explorer with Honeycomb and enabled show labels to get the availability percentage, hostname, and service name.

Note: you can change the status based on the configured status in your case

(builtin:osservice.availability:filter(prefix("dt.entity.os:service",CUSTOM_DEVICE-)):filter(or(eq("dt.osservice.status",running),eq("dt.osservice.status",active))):sum:auto:sort(value(sum,descending)):splitBy("dt.entity.host","dt.entity.os:service")/builtin:osservice.availability:filter(prefix("dt.entity.os:service",CUSTOM_DEVICE-)):sum:auto:sort(value(sum, descending)):splitBy("dt.entity.host","dt.entity.os:service")*100):setUnit(Percent):splitBy("dt.entity.host","dt.entity.os:service"):sort(value(auto,ascending)):limit(100)

Best regards,

Mohamed

[Mizső]

Hi @Mohamed_Hamdy,

Thanks very much for sharing it!!!

Best regards,

Mizső 

[sundarv1]

Hi Mohamed

How do we configure OS Service Monitoring alerts goes to specific workgroup. for all MSSQL OS Service monitoring to be sent to different assignment group. 

[Mohamed_Hamdy]

Hi @sundarv1 ,

You have a couple of options to consider. First, you can enable the alert option under OS services monitoring and specify the criteria and message. By default, this will generate a problem under availability. You can create an alerting profile and set up problem notifications for a specific group.

The second option is to create a metric event for more customization, followed by an alerting profile and problem notification.

Let me know if you need further assistance!

[sundarv1]

Mohammed - How do we create Metric event for Specific OS Service?. 

[Mohamed_Hamdy]

you can use Data Explorer then click on ... and add a metric event, same as the screenshot below, i have used the below query as a sample in the global demo environment, of course, you can use different one

(builtin:osservice.availability:filter(and(or(eq("dt.osservice.name","apl-easytravel")))):filter(or(eq("dt.osservice.status",running),eq("dt.osservice.status",active))):sum:auto:sort(value(sum,descending)):splitBy("dt.entity.host","dt.entity.os:service")/builtin:osservice.availability:filter(and(or(eq("dt.osservice.name","apl-easytravel")))):sum:auto:sort(value(sum, descending)):splitBy("dt.entity.host","dt.entity.os:service")*100):setUnit(Percent):splitBy("dt.entity.host","dt.entity.os:service"):sort(value(auto,ascending)):limit(100)

[tijust1]

@Mohamed_Hamdy Thanks for providing this use case as well as query.

[Yosi_Neuman]

Hi @Mizső ,

In out use case, customer asked to monitor all Windows OS services that are marked to be in running mode and are not running on server that is using OA in infrastructure mode.

HTH

Yos

[sia_h]

Hi,

Within some of my clients, we monitor essential services like backup software, antivirus software, and endpoint security software. Moreover, for Windows Servers we monitor services like SQL Server, IIS, and Windows Defender.

Display Name	Service Name
SQL Server	MSSQLSERVER
Windows Defender	WinDefend
IIS (Internet Information Services)	W3SVC

Sia