Admin Arsenal Monitors – Services

 

We’ve got a client who has several thousand computers and a dozen or so administrators. Without going into the hairy details, apparently some “power users” have been stopping Symantec Antivirus service while they work. Since the services are being stopped gracefully, the Windows Service Control manager won’t automatically restart the service. Our client wants to know how they can use Admin Arsenal to accomplish two tasks:

  1. When Symantec Antivirus service is stopped, restart it.
  2. Email a few interested managers that the service had been stopped.

This is a very easy project in Admin Arsenal. See the attached images to accomplish the same thing.

monitor-properties
Define your monitor. Name of service, Event (Stopped, Started, Not running etc) and Sample Rate (time interval to check for event).
1st-action
Define the Actions. In this case we have two actions. This action will send an email to two administrators with a description of the event.
2nd-action
This action simply directs Admin Arsenal to restart the service when the event is triggered.
Adding Targets | Admin Arsenal Monitors
Define the targets. Which computers will you monitor? You can add individual computers, Active Directory Organization Units (OU) or Admin Arsenal Collections.
Targets | Admin Arsenal
We have defined our targets. In this case we chose the Admin Arsenal Collection called Windows Vista Systems. Therefore, all Vista computers will be monitored.

Slam dunk. When the Symantec Service gets stopped on a target (in this case all Windows Vista systems) Admin Arsenal will restart the service and send an email alerting the necessary people. Note that the content of the email largely consists of variables such as {Monitor}, {Date/Time} etc. These are populated by selecting the “>” button and using the drop down to select which variables to report.