EP Ops Windows service monitoring

[MeImNot76]

Hello,

I'm using EPOps to monitor Windows services but have noticed that when a service goes down and an alert is sent, there is no mention of the server that hosts that service and since these service alerts are being catered for by engineers that atm don't have access to vROPS it is proving very unfruitful for us.

Does anyone know if it is possible to add the server name in the Windows service alert?

Thank you!

Info:VMware Tools Windows Service is acting abnormally since Thu Jul 12 08:06:00 UTC 2018 and was last updated at Thu Jul 12 08:06:00 UTC 2018

Alert Definition Name: Object is not available
Alert Definition Description: Object is not available
Object Name : VMware Tools
Object Type : Windows Service
Alert Impact: health
Alert State : critical
Alert Type : Application
Alert Sub-Type : Availability
Object Health State: critical
Object Risk State: info
Object Efficiency State: info
Control State: Open
Symptoms:
SYMPTOM SET - self

Symptom Name	Object Name	Object ID	Metric	Message Info
Object is not available	VMware Tools	1c221a06-a370-4a38-a162-83ca53cdcb61	AVAILABILITY|Resource Availability	0.0 = 0.0

 
Recommendations:
Notification Rule Name: All Windows Alerts
Notification Rule Description: All Windows Alerts
Alert ID : 30011573-7bc8-47bc-a464-a99789ad13ae
VCOps Server -

[mghall · Accepted solution]

You may want to change your alert definition so that it is created on the object type of Virtual Machine (to reflect the hostname) and not Windows Service.

Your symptoms may be to be adjusted as well. Something like this:

Symptoms Descendant-Windows Service

This symptom set is true when: any of descendant windows service objects exhibit all of the following symptoms.

1. Win Service display name "VMware Tools Windows Service is acting abnormally"

2. Win Service in not available

[MeImNot76]

mghall This has worked like a charm, Thank you!!

New alert was generated at Fri Jul 13 13:18:54 UTC 2018:
Info:MT-AUDIT01 VirtualMachine is acting abnormally since Fri Jul 13 13:18:54 UTC 2018 and was last updated at Fri Jul 13 13:18:54 UTC 2018

Alert Definition Name: _Windows Service Unavailable
Alert Definition Description: Alert showing the server name of the unavailable service
Object Name : MT-AUDIT01
Object Type : VirtualMachine
Alert Impact: health
Alert State : critical
Alert Type : Application
Alert Sub-Type : Availability
Object Health State: critical
Object Risk State: info
Object Efficiency State: info
Control State: Open
Symptoms:
SYMPTOM SET - descent

Symptom Name	Object Name	Object ID	Metric	Message Info
_Windows Service Availability	VMware Tools	85a0b04e-97bd-4520-838a-1285a079d4c2	AVAILABILITY|Resource Availability	0.0 < 100.0

[JVelasco2011101]

Did you change the Alert definition or created a new one?  I am having the same issue and not about to resort to appending the hostname to each Windows Service.  Basically just trying to find out what you did as this looks like it would work for us.

[mghall]

JVelasco,

You should be able to change the alert definiation, depending on how you're doing the defination. Edit the alert definiation and try changing the Base Object Type from Windows Service to Virtual Machine.

The symptom set should be true when Any descendant windows servce objects equal ALL of the symptoms.

For the Symptoms, you'll want to have one be the Win Service display name equal to your service. The other symptom should be Win Service not available.

Hope that helps.

[JVelasco2011101]

OK, yea i was trying to see if i could edit the alert definition "object not available" but it says its applied to all adapters so i cannot edit it.  Which one did you edit?

[RickVerstegen]

Indeed these cannot be edited.

I've created two symptoms and put them in a new alert definition.

I was wondering if you need create a set (two symptoms and one alert definition) for each service you want to monitor or can you group all the services you want in one set (multiple symptoms. depends on how many services and one alert definition)?

[Ezieleman80]

Hi @MelmNot76

Do you have some screenshots about this configuration?

Because i cant seem to find it to get the hostname of the vm within the e-mail notification

Thanx