In this post I will give detailed instructions on how to monitor a Windows service through SCOM 2012 R2.
For this example I will be creating a monitor to monitor a service called ‘LP360 License Server’ which only occurs on a single server
- Within the SCOM console, Navigate to the ‘Authoring’ tab, expand ‘Management Pack Objects’ and select ‘Monitors’
- Right click on ‘Monitors’, expand ‘Create a Monitor’ and select ‘Unit Monitor…’
- Expand ‘Windows Services’ and select ‘Basic Service Monitor’
- From the drop-down menu, select the management pack that you wish to place this monitor into. For custom monitors I create a management pack which i have called ‘Service Monitoring’. Then click ‘Next’
- Give your monitor a name that is unique and specific to what you are monitoring, I called mine ‘LP360 License Server’
- Select a monitor target. if this service is specific to an operating system such as Server 2008 R2, then search for and select ‘Windows Server 2008 R2 Computer’ of the Discovery management pack. Otherwise select ‘Windows Computer’ to cover all Windows server and clients. Then click ‘Next’
- Select a ‘Parent monitor’ from the drop-down box. for custom monitors I create an Aggregate Rollup Monitor which is called ‘Custom Services’. If you have not got a custom one, select ‘Availability’, it can always be changed later
- Because this service is only on one server, I do not want the monitor enabled by default. Untick ‘Montor is enabled’, then click ‘Next’
- If you are confident of the service name then type it in the box. I strongly suggest clicking on the ‘…’ button
- Click ‘…’, type the server name and click ‘OK’
- Locate the service you wish to monitor and click ‘OK’. When you use this method there can be no doubt as to the service name
- Click ‘Next’
- The default health states are fine for monitoring services, so unless you have specific requirements for something different, click ‘Next’
- I turn on alerts for all service monitors, select ‘Generate alerts for this monitor
‘ - Change the ‘Alert description’ to something that makes sense for you, mine is ‘The ‘LP360 Server’ Service has stopped.”
- Click ‘Create’
- Search ‘Monitors’ for your monitor, locate it under ‘Windows Computer’. Right click, expand ‘Overrides’, then ‘Override the Monitor’. Select ‘For a specific object of class: Windows Computer’
- Search for the server that is running the service, select the server and click ‘OK’
- Tick the ‘Override’ box the corresponds to the ‘Enabled’ parameter, then change the ‘Override Value’ to ‘True’. Click ‘OK’
- Navigate to the ‘Monitoring’ tab, then select ‘Windows Computers’
- Search for the server you just created the override for. Right click on the server, expand ‘Open’, select ‘Health Explorer’ for your server
- Navigate to where you placed the monitor, in my case it was ‘Custom Services’. Depending on your setup, you may have to clear the filter, it will be a yellow bar at the top of the left pane
- Click on State Change Events to confirm when the monitor became active. It could take up to an hour for the monitor to become active. This is dependent on the amount of clients you are monitoring and the performance of your SCOM infrastructure
Liam Matthews IT 
Thanks, its explained very well.
I have a question, can we fetch the stopped service report for specific or group of servers. The report should show the monitored service stop duration for server.
You should absolutely be able to do this, have have been rebuilding my lab and currently do not have access to another SCOM server to provide more information but watch this space
Complete SCOM n00b here. Thank you, this works like a charm. Do you have any recommendations for monitoring multiple servers?
Great info, well presented. Thank you for saving me much digging around!
Could anyone can explain What does ” Windows Services” tab Does? – Which is in Authoring – Management pack Templates – Windows Services ? ( 2007 R2 version)
Already we can configuring customized alert under Monitoring Tab.
Please help me on this.
Hey, Sorry if this resurrects the thread from the dead but i don’t really know where else to ask this question. I have created some custom monitors to monitor windows services. I’ve targeted windows computer and have disabled the monitor by default and only enabled for certain servers. If i view the health explorer of a server that i have not enabled the monitor on i see that the service i want to monitor shows up in the health explorer and is set to not monitored, how can i hide that on servers that i am not wanting to monitor the service on?
When you built this monitor, did you enable it or disable it? If you disable it by default and then enable it via an override to the computer objects, or group of computer objects (ideal), you’ll ensure you only monitor the instances you want. you can then easily handle adding or removing systems from this monitor by managing the group membership.
Thanks for the comment Kyle. As Blake said you need to ensure that you disable the monitor by default then enable only on instances where you wish to see it. This however, does not hide it within the Health Explorer. Unfortunately there is no way to hide it from the Health Explorer as long as the instance is within the target group. So if you have your target set to Windows Server, then any servers will have this monitor shown even if not enabled. The only way to hide it is to get more specific with targets but this can be very limited.
My suggestion is to nest all service monitors within their own parent monitor as I have done with “Custom Serices”. I found that this is the best way to clean things up