$Config/ComputerName$ $Config/ServiceName$ $Config/IntervalSeconds$ true true $Config/ComputerName$ $Config/ServiceName$ Property[@Name='StartMode'] Equal 4 Property[@Name='State'] Equal 4 Property[@Name='StartMode'] NotEqual 4 Property[@Name='State'] NotEqual 4 $Config/Samples$ Discovery root\cimv2 86397 $MPElement[Name="##CompanyID##.##AppName##.##UniqueID##.Class"]$ $MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$ $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$ $MPElement[Name="System!System.Entity"]/DisplayName$ $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$ $MPElement[Name="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceName$ $Data/Property[@Name='Name']$ $MPElement[Name="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceDisplayName$ $Data/Property[@Name='DisplayName']$ Alert $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$ Operations Manager EventDisplayNumber Equal 3751 PublisherName Equal Health Service Script Params/Param[2] ContainsSubstring $Target/Property[Type="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceName$ 1 2 $MPElement[Name="##CompanyID##.##AppName##.##UniqueID##.ServiceNotFound.Recovery.Rule.AlertMessage"]$ $Data/EventDescription$ $Data[Default='']/EventDisplayNumber$ $Data[Default='']/PublisherName$ $Data[Default='']/LoggingComputer$ Alert $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$ Operations Manager EventDisplayNumber Equal 3752 PublisherName Equal Health Service Script Params/Param[2] ContainsSubstring $Target/Property[Type="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceName$ 1 2 $MPElement[Name="##CompanyID##.##AppName##.##UniqueID##.ServiceFoundRunning.Recovery.Rule.AlertMessage"]$ $Data/EventDescription$ $Data[Default='']/EventDisplayNumber$ $Data[Default='']/PublisherName$ $Data[Default='']/LoggingComputer$ Alert $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$ Operations Manager EventDisplayNumber Equal 3753 PublisherName Equal Health Service Script Params/Param[2] ContainsSubstring $Target/Property[Type="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceName$ 1 2 $MPElement[Name="##CompanyID##.##AppName##.##UniqueID##.ServiceRecoveryFailed.Recovery.Rule.AlertMessage"]$ $Data/EventDescription$ $Data[Default='']/EventDisplayNumber$ $Data[Default='']/PublisherName$ $Data[Default='']/LoggingComputer$ Alert $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$ Operations Manager EventDisplayNumber Equal 3754 PublisherName Equal Health Service Script Params/Param[2] ContainsSubstring $Target/Property[Type="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceName$ 1 2 $MPElement[Name="##CompanyID##.##AppName##.##UniqueID##.TooManyRecoveryAttempts.Recovery.Rule.AlertMessage"]$ $Data/EventDescription$ $Data[Default='']/EventDisplayNumber$ $Data[Default='']/PublisherName$ $Data[Default='']/LoggingComputer$ AvailabilityHealth Warning true Normal Error $Data/Context/Property[@Name='Name']$ $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$ $Target/Property[Type="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceName$ 60 3 Custom ##CompanyID##.##AppName##.##UniqueID##.Service.Recovery.ps1 #================================================================================= # Script to restart a service # # Author: Kevin Holman # # Version: 1.1 # #================================================================================= param([string]$ServiceName,[string]$ServiceDisplayName) # Manual Testing section - put stuff here for manually testing script - typically parameters: #================================================================================= # $ServiceName = "spooler" # $ServiceDisplayName = "Print Spooler" #================================================================================= # Constants section - modify stuff here: #================================================================================= # Assign script name variable for use in event logging $ScriptName = "##CompanyID##.##AppName##.##UniqueID##.Service.Recovery.ps1" $EventID = "3750" #================================================================================= # Starting Script section #================================================================================= # Gather the start time of the script $StartTime = Get-Date #Set variable to be used in logging events $whoami = whoami # Load MOMScript API $momapi = New-Object -comObject MOM.ScriptAPI #================================================================================= # Begin MAIN script section #================================================================================= #Log script event that we are starting task $Message = "`nRecovery script for service: ($ServiceName) is starting. `nRunning as ($whoami)." $momapi.LogScriptEvent($ScriptName,$EventID,0,$Message) write-host $Message #Get the service object $Svc = Get-Service $ServiceName #Check to ensure the service exists: IF (!$Svc) { $Message = "`nService with Name: ($ServiceName) and DisplayName: ($ServiceDisplayName) was not found on this computer. `nThis indicates a misconfiguration of the monitor. `nError is ($error)" $momapi.LogScriptEvent($ScriptName,3751,2,$Message) write-host $Message EXIT } #Get Service Status: [string]$SvcStatus = $Svc.Status #Do not continue is service is already running IF ($SvcStatus -eq "Running") { $Message = "`nService with Name: ($ServiceName) and DisplayName: ($ServiceDisplayName) was found to be in the Running state. `nThis indicates a misconfiguration of the monitor. `nNo recovery action will be taken." $momapi.LogScriptEvent($ScriptName,3752,2,$Message) write-host $Message EXIT } #Since we assume the service is not Running - Log recovery information event $Message = "`nService with Name: ($ServiceName) and DisplayName: ($ServiceDisplayName) was found to be in the ($SvcStatus) state. First attempt at recovery starting now." $momapi.LogScriptEvent($ScriptName,$EventID,0,$Message) write-host $Message #Attempt First Recovery Restart-Service -Name $ServiceName -Force #Wait time in seconds Start-Sleep 20 #Get the service object $Svc = Get-Service $ServiceName #Get Service Status: $SvcStatus = $Svc.Status IF ($SvcStatus -ne "Running") { #Attempt Second Recovery $Message = "`nService with Name: ($ServiceName) and DisplayName: ($ServiceDisplayName) second attempt at recovery starting now." $momapi.LogScriptEvent($ScriptName,$EventID,0,$Message) write-host $Message Restart-Service -Name $ServiceName -Force Start-Sleep 20 $Svc = Get-Service $ServiceName $SvcStatus = $Svc.Status } IF ($SvcStatus -ne "Running") { #Attempt Third Recovery $Message = "`nService with Name: ($ServiceName) and DisplayName: ($ServiceDisplayName) third attempt at recovery starting now." $momapi.LogScriptEvent($ScriptName,$EventID,0,$Message) write-host $Message Restart-Service -Name $ServiceName -Force Start-Sleep 20 $Svc = Get-Service $ServiceName $SvcStatus = $Svc.Status } IF ($SvcStatus -eq "Running") { #Log event of a successful restart $Message = "`nService with Name: ($ServiceName) and DisplayName: ($ServiceDisplayName) was successfully restarted and then detected to be in the Running state." $momapi.LogScriptEvent($ScriptName,$EventID,0,$Message) write-host $Message } ELSE { #Log event of a failed restart $Message = "`nService with Name: ($ServiceName) and DisplayName: ($ServiceDisplayName) is not running. `nRecovery was attempted and failed. `nManual interventon is required. `nThe last detected service status was ($SvcStatus)." $momapi.LogScriptEvent($ScriptName,3753,2,$Message) write-host $Message } # Check to see if this recovery script has been run multiple times in the last x minutes for detection of too many recovery actions $Message = "*($ServiceName) is starting*" $Events = Get-EventLog -LogName 'Operations Manager' -After $StartTime.AddMinutes(-60) -Message $Message | where {$_.EventID -eq 3750} $EventCount = $Events.Count IF ($EventCount -ge 3) { $Message = "`nToo many service recoveries have been attempted for service with name: ($ServiceName) and DisplayName: ($ServiceDisplayName). `n($EventCount) recoveries are detected in the event log. `nManual interventon is required." $momapi.LogScriptEvent($ScriptName,3754,2,$Message) write-host $Message } # End of script section #================================================================================= #Log an event for script ending and total execution time. $EndTime = Get-Date $ScriptTime = ($EndTime - $StartTime).TotalSeconds $Message = "`nRecovery Script Completed. `nScript Runtime: ($ScriptTime) seconds." $momapi.LogScriptEvent($ScriptName,$EventID,0,$Message) write-host $Message #================================================================================= # End of script ServiceName $Target/Property[Type="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceName$ ServiceDisplayName $Target/Property[Type="##CompanyID##.##AppName##.##UniqueID##.Class"]/ServiceDisplayName$ 240 ##CompanyID## ##AppName## ##UniqueID## Class ServiceName ##CompanyID## ##AppName## ##UniqueID## Class Discovery ##CompanyID## ##AppName## ##UniqueID## Service Monitor Running Not Running ##AppName## ##UniqueID## service is not running Service {0} is not running on {1} ##CompanyID## ##AppName## ##UniqueID## Service Recovery ##CompanyID## ##AppName## ##UniqueID## Service Recovery Failed - Service Not Found ##AppName## ##UniqueID## Service Recovery Failed - Service Not Found Event Description: {0} ##CompanyID## ##AppName## ##UniqueID## Service Recovery Failed - Service Already Running ##AppName## ##UniqueID## Service Recovery Failed - Service Already Running Event Description: {0} ##CompanyID## ##AppName## ##UniqueID## Service Recovery Failed - Service is not running ##AppName## ##UniqueID## Service Recovery Failed - Service is not running Event Description: {0} ##CompanyID## ##AppName## ##UniqueID## Service Recovery has attempted to recover the service too many times ##AppName## ##UniqueID## Service Recovery has attempted to recover the service too many times Event Description: {0}