Monitoring Windows services with PowerShell

To monitor the state of Windows services, we can even turn to PowerShell. This post's script will send you email alerts whenever one of your crucial Windows services is not running.

Monitoring your infrastructure is an extremely important aspect of managing your systems. If services go down, IT needs to find this out as soon as possible so they can begin the process of bringing them back up. This is common practice for system administrators. To monitor systems there are a slew of tools available. Some of these include Nagios, Monitis, and WhatsUp Gold. However, with the PowerShell script in this post, you can quickly set up your own flexible monitoring solution.

PowerShell service cmdlets ^

PowerShell provides the ability to query, start, stop, restart, set, and even create Windows services. For instance, to get the current status of the remote registry service, we can simply run:

Getting the current status of the RemoteRegistry service

Getting the current status of the RemoteRegistry service

I can see the current status is "Stopped" as well as see other properties such as the dependent services. For the purposes of monitoring services, we will only be using Get-Service, but to start the remote registry service, I can run Start-Service:

Starting a service with Start Service

Starting a service with Start Service

Get-PSServiceStatus function overview ^

Using Get-Service allows us to get the service status both locally and remotely, but we also want the capability to receive alerts via email if the status of a service has changed. We can do this with Send-MailMessage as you will see in the function.

Normally, enterprise products use a database to keep track of the status on each polling and then send an alert if the status has changed. While this is still possible with PowerShell, I will keep it simple by only keeping track of the last status polled. To do this, I'll use the presence of a text file and send an alert if that has changed. The flow of this function goes:

  1. For each computer, check to see if a text file is present and if a service is running. An existing text file indicates the service was not running on the previous monitoring attempt.
  2. If the service is not running and the text file is present, do nothing since the status has not changed.
  3. If the service is not running and no text file is present, create the text file and send an email alert stating the service is not running.
  4. If the service is running and the text file is present, delete the text file and send an alert that the service is now running.
  5. If the service is running and the text file is not present, do nothing.

The latest version of my Get-PSServiceStatus function is on Github.

Using Get-PSServiceStatus ^

To show how this function works, we will monitor the remote registry service against two computers, test-1 and test-2. Test-1 currently has its remote registry service stopped, while it's running on test-2. Note the -Path parameter is the location to store your text files indicating services are not running.

This alerts us via the console and by email that the remote registry service on test-1 is not running.

Starting the remote registry service on test-1 and running the same command again alerts us that the service is now running:

Creating a scheduled task to run Get-PSServiceStatus ^

To automate this solution further, we can create a scheduled task to run Get-PSServiceStatus at a certain interval, for instance every 30 minutes. To create the task we will use schtask.exe to run a PowerShell script that includes the Get-PSServiceStatus function.

Here, I will create a scheduled task to run Get-PSSServiceStatus in a PowerShell script every 15 minutes under the logged-in account. The script will query all computers in the "Servers" organizational unit (OU) in Active Directory and check the status of the SNMP service.

Here is the "Get-PSServiceStatus-Servers.ps1" scheduled task script:

Join the 4sysops PowerShell group!

Your question was not answered? Ask in the forum!

3+
avataravatar
Share
4 Comments
  1. Rob Clarke 2 years ago

    What a great post. Exactly what I needed, an email alert when a service is not running.

    We had an instance where the Azure AD Connect service stopped. The Office 365 portal did not alert us and it hadn't synced for 65 hours. Looked at creating custom alerts in the portal but you need an Azure Premium subscription to do this.
    Reporting on the failed service is the next best thing.

    Thanks!

    0

  2. Python 1 year ago

    great post. Why am I getting the error? I am running the PowerShell script from the same folder where I have saved the .ps file and running PowerShell ISE as an admin.

     

    Get-PSServiceStatus : The term 'Get-PSServiceStatus' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was 
    included, verify that the path is correct and try again.
    At line:1 char:1
    + Get-PSServiceStatus -ComputerName wafstcapd02 -ServiceName 'Tomcat8.0 ...
    + ~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : ObjectNotFound: (Get-PSServiceStatus:String) [], CommandNotFoundException
        + FullyQualifiedErrorId : CommandNotFoundException

    1+
    avatar
    • Please dot source the stored script and then try to run the function.

       

      0

  3. Vaneet 11 months ago

    Thanks for the wonderful script Dan :).

    I have query for email function, because I didn't get the email with the steps provided by you.

    -How email function will work, do we need to supply the credential in the script by using (System.Net.NetworkCredential) ?

    0

Leave a reply

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2020

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account