Monitor windows server service

In brief, you need to create a log analytics workspace, deploy monitoring agents to the required servers, configure performance counters within the log analytics workspace to capture the system events, run a log query to identify the service and its status, and create an Azure alert to monitor the status of the service and generate an email when the status of the has service changed.

To keep up with the news and updates related to our products, make sure to subscribe to our newsletter! Please provide us with a brief description of the issue you're facing. One of our support agents will get back to you shortly. This website uses cookies to improve user experience. By using our website you consent to all cookies in accordance with our Cookie Policy. Privacy details I accept. If you want to turn off a specific solution within a workspace, you will need to remove the monitoring solution from the Azure portal.

Removing a monitoring solution means that the insights created by that solution will no longer be generated for any of the servers reporting to that workspace. For example, if I uninstall the Azure Monitor for VMs solution, I will no longer see insights about VM or server performance from any of the machines connected to my workspace. Skip to main content. This browser is no longer supported.

Download Microsoft Edge More info. Contents Exit focus mode. Is this page helpful? Please rate your experience Yes No. Any additional feedback? Note Despite its name, VM insights works for physical servers as well as virtual machines. We will filter on Event Id from System log. This event contains information which service has stopped or started.

That information is contained in EventData column but is unstructured. By using the Log Analytics powerful language we will structure that data very nicely. This is done by executing the following query:. As you can see from the screenshot we have the Computer in question, the service name, the state — stopped and running when it was started and the time. Keep in mind this is point in time state and I suggest to automate so that when service is stopped you fire a runbook that starts it.

By having the actual name of the service this is pretty easy. Remember also to filter on the services that you want to monitor because there are a lot of services that start and stop all the time especially on Windows Server Stanislav Zhelyazkov has been working in IT since His blogposts can be found at www.

View all posts by Stanislav Zhelyazkov. I cannot share the exact runbook but you get the data from Log Analytics — Computer and Service Name.

You will have hybrid worker where the remediation work, the hybrid worker will execute the runbook. Simple as that. There is no special magic to the runbook. Yes, It is very simple. Fill the service name in quotes. Any Log Analytics string operators are available for you to filter. Should the original query not show all services? This however shows not result although the service exists.

Hi, With this solution we monitor only the states happening with the services. You will not see all your services there you will only see services when they are stopped or started. When a service is stopped or started there is specific event logged in the System Event Log. We track that event so we know at what specific time service was started or stopped.

The query visualizes those actions and can be used for creating alert to monitor if specific service was stopped for example. This is possible by using metric alerts. Hi There is probably problem with copying the query. When you copy it it there might be empty lines. Remove the empty lines in the query.

Would it be possible to have a widget on the dashboard showing the services that are currently down? You can create Log Analytics View to show you the stopped services. Keep in mind that will show you when service was stopped but not if the service is still stopped.

Type the name of the service that you are monitoring. To open the Choose a Service dialog box, click the ellipsis Select to invoke the Monitor Service activity when the selected service has been stopped or paused.

When a service is restarted using the Windows Service Control Manager it is stopped and then started in succession. This will cause the Monitor Service activity to be invoked regardless of whether you have specified to invoke when the Service is started or Service is stopped or paused.

Select the Restart stopped service box to restart a service that has stopped. Select the amount of time to wait between each time that the Monitor Service activity checks the status of the service.