LabTech Support Forums

Is there a way to modify or disable the service monitor?

This forum is for discussion of monitor related issues.

Moderator: jware.connectwise

Is there a way to modify or disable the service monitor?

Postby lfawkes » Wed Feb 29, 2012 5:46 pm

Hi, this doesn't seem to be a "monitor" per se, as far as I can tell it's something that's just built into Labtech. This seemed like the best section for this question though.

But whatever it is that's creating the "Service X is Service X is Stopped for Y" (yes, with the stutter) tickets, I need to make it stop. Every night, in the middle of the night, it's flooding our ticketing system with tickets for a number of services being stopped on a number of machines, then auto-closing them.

Also, on servers where we have certain services deliberately disabled, such as the "BackupExecJobEngine" service on one server where they're not currently using that program, I'd like to stop it from triggering alerts.

I've looked everywhere - internal monitors, system monitors, scripts, searches... I can't find this anywhere.
lfawkes
Newbie
Newbie
 
Posts: 8
Joined: Wed Jun 22, 2011 5:05 pm

Re: Is there a way to modify or disable the service monitor?

Postby lfawkes » Wed Feb 29, 2012 5:48 pm

An example of one such ticket:

Summary: "Service BackupExecJobEngine is Service BackupExecJobEngine is Stopped for [someserver]"

Detail Description: "The Service Monitor detected that the service BackupExecJobEngine is Service BackupExecJobEngine is Stopped."

Internal Analysis: "The service BackupExecJobEngine has been restarted but did not return to the running state."
lfawkes
Newbie
Newbie
 
Posts: 8
Joined: Wed Jun 22, 2011 5:05 pm

Re: Is there a way to modify or disable the service monitor?

Postby nathan.sheppard.camelon » Thu Mar 01, 2012 9:36 am

Hi Lee, sounds like the monitors built into the backup exec groups under Groups -> Storage Management -> Backup Exec.

You could either uninstall the software, ensuring the service is removed completely (SC DELETE SERVICENAME if it doesn't remove cleanly) - or in the search filter that group uses, you could tell it to specifically exclude those machines causing you headaches.

The 'better' way would be to remove the software :)
Image
nathan.sheppard@camelon.com.au
User avatar
nathan.sheppard.camelon
Jr. Member
Jr. Member
 
Posts: 64
Joined: Sat Mar 03, 2012 3:13 am

Re: Is there a way to modify or disable the service monitor?

Postby lfawkes » Thu Mar 01, 2012 12:16 pm

Thanks for the reply Nathan.

I looked at the "Storage Management\Backup Exec" group, and went ahead and removed that server from the search which places it in that group.

However, I don't see anything associated with that group which would create those "Service is missing" tickets. There is a script that runs, but all it does is check the log files for errors. There are five Internal Monitors active on that group, and none of them have anything to do with services. There are no Remote Monitors active on that group.

Also, I still can't find anything for the services that are tripping the "service is missing" tickets on random other machines. Those services are Spooler, SamSs, RpcSs, PlugPlay, Eventlog, and Dnscache.

Does anyone know any other places I might look?
lfawkes
Newbie
Newbie
 
Posts: 8
Joined: Wed Jun 22, 2011 5:05 pm

Re: Is there a way to modify or disable the service monitor?

Postby nathan.sheppard.camelon » Fri Mar 02, 2012 5:53 am

What about the auto services stopped monitor? It's possible there is an alert template which runs a script for autofix\restart services. This script will create a ticket if programatically starting the service fails.

I'd check what monitors are assigned to that node via the computer console screen, Effective Policy. It will also tell you what group assigned that monitor.

I'd be willing to bet there is an alert template set to run a script, which creates a ticket.
Image
nathan.sheppard@camelon.com.au
User avatar
nathan.sheppard.camelon
Jr. Member
Jr. Member
 
Posts: 64
Joined: Sat Mar 03, 2012 3:13 am

Re: Is there a way to modify or disable the service monitor?

Postby cciecka.c-cured » Fri Mar 02, 2012 11:59 am

Lee,

I believe that you are complaining about the auto services stopped monitor. You can edit the monitor to exclude specific services by:

  1. Click on Monitors
  2. Click on the Internal Monitors Tab
  3. Double Click Auto Services Stopped monitor entry
  4. Under the "Additional Conditions" section add the service name into the list.

I was unhappy with a bunch of services alarming so mine additional conditions now looks like this:

services.Startup='Auto' and services.Name not in ('WZCSVC','Fax','StiSvc','WinDefend','MMCSS','sppsvc','MHN','ehstart','DPS','SysmonLog','winvnc','wscsvc','srservice','Browser','TPM','TBS','ShellHWDetection','wlms','clr_optimization_v4.0.30319_32','clr_optimization_v4.0.30319_64','clr_optimization_v2.0.50727_32','BBSvc','tcsd_win32.exe','gupdate','GotoMyPC','Brother XP spl Service','Net Driver HPz12','Pml Driver HPZ12','RoxWatch9','RoxWatch12','RoxLiveShare9','DellDigitalDelivery') and services.Display not like '%Printer%' and computers.OS like '%Windows%' AND Services.Driver=0

I might be overboard on this at this point but I have far fewer false positives than when we started.
cciecka.c-cured
Newbie
Newbie
 
Posts: 48
Joined: Sat May 14, 2011 1:54 pm

Re: Is there a way to modify or disable the service monitor?

Postby lfawkes » Fri Mar 02, 2012 12:14 pm

Thanks for the comments, Nathan and Cciecka.

All service-related monitors, including "Auto Services Stopped", are set to "No Alert" and "Do Nothing". I just manually ran "Auto Services Stopped", and no tickets were generated.

I found an obscure mention somewhere about a Daily Health Check script which might have been doing it, but I can't find that either.

I've also opened a ticket for this, since my boss is starting to get on me about it.
lfawkes
Newbie
Newbie
 
Posts: 8
Joined: Wed Jun 22, 2011 5:05 pm

Re: Is there a way to modify or disable the service monitor?

Postby lfawkes » Fri Mar 02, 2012 12:17 pm

Oh, one other detail that's probably relevant: the tickets for the computers at one client are generated at around 3:40am, and the tickets for a different set of computers at another client are generated around 5:00am.

I think that rules out anything in Internal Monitors.
lfawkes
Newbie
Newbie
 
Posts: 8
Joined: Wed Jun 22, 2011 5:05 pm

Re: Is there a way to modify or disable the service monitor?

Postby jgaskell.greyhound-tech » Wed Apr 11, 2012 1:25 pm

I'm having the same problem. I also get a lot of these: [Service is 32126ms Response Time for SVR-SBS01] (Yes, the service name is missing).

I've tracked it down - or at least where the ticket is being created from. It's buried in a script. The remote monitor that fires the script is created as part of the Onboarding process.

Go to the machine in question and take a look at the Remote Monitors - specifically the ones that watch services. Open up one of the monitors, and see if the Alerting tab lists Autofix Actions\Monitor Restart Service or anything similar as the script that will run.

If you dig into that script, you'll find where it creates the ticket. I'm not a fan because of how inappropriately this monitor/script combo seems to perform. We get TONS of false positive or non-issue tickets created. Many of them don't give the service name or adequately describe the situation.

I think the part of the problem is the service restart script is being fired against a monitor other than a service-related monitor. I haven't found where that's happening in my config yet, but I'm certain it is.

The bigger issue is that these monitors aren't handled from the Internal Monitors that I assign as part of my service plans - which means tickets are being created for servers I don't want managed in that way.

As lee said, it isn't immediately obvious where these tickets are coming from, or how to change the ticket creation behavior - which in my mind is a problem.

I would love to hear some feedback from LT on this.
-Jonathan
User avatar
jgaskell.greyhound-tech
Newbie
Newbie
 
Posts: 18
Joined: Mon Dec 12, 2011 4:23 pm

Re: Is there a way to modify or disable the service monitor?

Postby scott.redfireit » Fri Jul 06, 2012 2:18 am

We have the same problem with those tickets too. Did anyone find a resolution to this? I have opened a ticket with support but they have no idea either.
scott.redfireit
Newbie
Newbie
 
Posts: 11
Joined: Mon Jun 13, 2011 8:49 pm

Re: Is there a way to modify or disable the service monitor?

Postby dmonks.lairservices » Thu Jun 23, 2016 10:47 am

Not sure if anyone else has figured this out.

I found, in the scripts folder, Autofix Actions -> Monitor Restart Service. In this script there is a section for ticket generation. I ripped this out. Monitor still restarts service, but no more tickets are generated.
dmonks.lairservices
Newbie
Newbie
 
Posts: 2
Joined: Fri Sep 12, 2014 9:46 am


Return to Monitors

Who is online

Users browsing this forum: No registered users and 3 guests

cron