Monitoring Windows services with PowerShell

• Author
• Recent Posts

Dan Franciscus

Dan Franciscus is a systems engineer and VMware Certified Professional (VCP) specializing in VMware, PowerShell, and other Microsoft-based technologies. You can reach Dan at his blog or his Twitter at @dan_franciscus.

Latest posts by Dan Franciscus (see all)

• SolarWinds Server Performance and Configuration Bundle - Tue, Jun 18 2019
• SolarWinds Patch Manager: Updating Windows and third-party software - Tue, Apr 30 2019
• Monitor file changes in Windows with PowerShell and pswatch - Fri, Feb 1 2019

Monitoring your infrastructure is an extremely important aspect of managing your systems. If services go down, IT needs to find this out as soon as possible so they can begin the process of bringing them back up. This is common practice for system administrators. To monitor systems there are a slew of tools available. Some of these include Nagios, Monitis, and WhatsUp Gold. However, with the PowerShell script in this post, you can quickly set up your own flexible monitoring solution.

PowerShell service cmdlets

PowerShell provides the ability to query, start, stop, restart, set, and even create Windows services. For instance, to get the current status of the remote registry service, we can simply run:

Getting the current status of the RemoteRegistry service

I can see the current status is "Stopped" as well as see other properties such as the dependent services. For the purposes of monitoring services, we will only be using Get-Service, but to start the remote registry service, I can run Start-Service:

Starting a service with Start Service

Get-PSServiceStatus function overview

Using Get-Service allows us to get the service status both locally and remotely, but we also want the capability to receive alerts via email if the status of a service has changed. We can do this with Send-MailMessage as you will see in the function.

Normally, enterprise products use a database to keep track of the status on each polling and then send an alert if the status has changed. While this is still possible with PowerShell, I will keep it simple by only keeping track of the last status polled. To do this, I'll use the presence of a text file and send an alert if that has changed. The flow of this function goes:

1. For each computer, check to see if a text file is present and if a service is running. An existing text file indicates the service was not running on the previous monitoring attempt.
2. If the service is not running and the text file is present, do nothing since the status has not changed.
3. If the service is not running and no text file is present, create the text file and send an email alert stating the service is not running.
4. If the service is running and the text file is present, delete the text file and send an alert that the service is now running.
5. If the service is running and the text file is not present, do nothing.

The latest version of my Get-PSServiceStatus function is on Github.

function Get-PSServiceStatus {

param (
    [string[]]$ComputerName,
    [string]$ServiceName,
    [string]$Path,
    [string]$FromAddress,
    [string]$ToAddress,
    [string]$SmtpServer
)
    # Test ping
    workflow Test-Ping 
    {
        param( 
            [Parameter(Mandatory=$true)] 
            [string[]]$Computers
        )
            foreach -parallel -throttlelimit 150 ($Computer in $Computers) 
            {
                if (Test-Connection -Count 1 $Computer -Quiet -ErrorAction SilentlyContinue) 
                {    
                    $Computer
                }
                else
                {
                    Write-Warning -Message "$Computer not online"
                }
            }
        }
    $ComputerName = Test-Ping -Computers $ComputerName 

    foreach ($Computer in $ComputerName)
    {
    $NewPath = Join-Path -Path $Path -ChildPath $Computer
        #Get previous status
        if (Test-Path -Path $NewPath)
        {
            $PreviousStatus = 'Not Running'
        }
        else 
        {
            $PreviousStatus = 'Running'    
        }

        #Get current status
        $CurrentStatus = Get-Service -Name $ServiceName -ComputerName $Computer | Where-Object {$_.Status -eq 'Running'}
        if ($CurrentStatus)
        {
            $CurrentStatus = 'Running'
        }
        else 
        {
            $CurrentStatus = 'Not Running'    
        }
        
        #Current status running and previous up
        if ($PreviousStatus -eq 'Running' -and $CurrentStatus -eq 'Running')
        {
            Write-Output "$Computer $ServiceName still running"
            Continue
        }

        #Current status running and previous down
        if ($PreviousStatus -eq 'Not Running' -and $CurrentStatus -eq 'Running')
        {
            Write-Warning -Message "$Computer $ServiceName now running"
            Remove-Item -Path $NewPath -Force | Out-Null
            Send-MailMessage -Body ' ' -From "$FromAddress" -SmtpServer "$SmtpServer" -Subject "$Computer $ServiceName is now running" -To $ToAddress 
            Continue
        }

        #Current status down and previous down 
        if ($PreviousStatus -eq 'Not Running' -and $CurrentStatus -eq 'Not Running')
        {
            Write-Warning -Message "$Computer $ServiceName still not running"
            New-Item -Path $NewPath -ItemType File -Force | Out-Null
            Continue
        }

        #Current status down and previous up 
        if ($PreviousStatus -eq 'Running' -and $CurrentStatus -eq 'Not Running')
        {
            Write-Warning -Message "$Computer $ServiceName is not running"
            New-Item -Path $NewPath -ItemType File -Force | Out-Null
            Send-MailMessage -Body ' ' -From "$FromAddress" -SmtpServer "$SmtpServer" -Subject "$Computer $ServiceName is not running" -To $ToAddress 
            Continue
        }
    }
}

Using Get-PSServiceStatus

To show how this function works, we will monitor the remote registry service against two computers, test-1 and test-2. Test-1 currently has its remote registry service stopped, while it's running on test-2. Note the -Path parameter is the location to store your text files indicating services are not running.

C:\> Get-PSServiceStatus -ComputerName test-1,test-2 -ServiceName 'RemoteRegistry' -Path 'C:\PSService\' -FromAddress 'alerts@domain.com' ‑ToAddress 'dfrancis@domain.com' -SmtpServer 'smtp.domain.com'
WARNING: test-1 RemoteRegistry is not running
test-2 RemoteRegistry still running

This alerts us via the console and by email that the remote registry service on test-1 is not running.

Starting the remote registry service on test-1 and running the same command again alerts us that the service is now running:

C:\> Get-PSServiceStatus -ComputerName test-1,test-2 -ServiceName 'RemoteRegistry' -Path 'C:\PSService\' -FromAddress 'alerts@domain.com’ -ToAddress 'dfrancis@domain.com' -SmtpServer 'smtp.domain.com'
WARNING: test-1 RemoteRegistry is now running
test-2 RemoteRegistry still running

Creating a scheduled task to run Get-PSServiceStatus

To automate this solution further, we can create a scheduled task to run Get-PSServiceStatus at a certain interval, for instance every 30 minutes. To create the task we will use schtask.exe to run a PowerShell script that includes the Get-PSServiceStatus function.

Here, I will create a scheduled task to run Get-PSSServiceStatus in a PowerShell script every 15 minutes under the logged-in account. The script will query all computers in the "Servers" organizational unit (OU) in Active Directory and check the status of the SNMP service.

Schtasks.exe /CREATE /TN Get-PSSService /TR "Powershell.exe C:\Scripts\Get-PSServiceStatus-Servers.ps1" /RL HIGHEST /F /SC DAILY /RI 15 /ST 00:00

Here is the "Get-PSServiceStatus-Servers.ps1" scheduled task script:

Import-Module Get-PSServiceStatus
Get-PSServiceStatus -ComputerName (Get-ADComputer -SearchBase 'OU=Servers,DC=domain,DC=com' -Filter * | Select-Object -ExpandProperty name) ‑ServiceName 'SNMP' -Path 'C:\PSService\' -FromAddress 'alerts@domain.com’ ‑ToAddress 'dfrancis@domain.com' -SmtpServer 'smtp.domain.com'