Can Insight Manager 5 Monitor Windows Services?

[Richard Layton_2]

I have seen a few posts about monitoring Windows Services but they all point to OpenView. Can Insight monitor the status of a service(ie started/starting/stopped/stopping) and alert on it?

Thanks

[David Claypool]

We need to talk about both ends of the wire. On the HP SIM side, it can receive events from any SNMP agent that cares to send something to it as long as it has a MIB to decode it.

At the other end of the wire, the capability you are asking about is a feature of the Insight management agents/System Management Homepage. Access it in the Control Panel applet called 'HP Management Agent' and look at the tab called 'Process Monitor'

[Bill Gushue]

So, after configuring on the Server side (for ex., to be alerted when the PC AnyWhere Host service - awhost32 is stopped) is there anything I have to do on SIM's side, or will I simply start getting alerts after the snmp and HP agents are restarted?

Thanks.

[Richard Layton_2]

I am having a hrad time finding any documentation that shows how to use this feature. I am testing it attempting to see what happens and so far nothing. I have setup calc.exe process with the stop option. I am not sure what those options mean. If I select stop does that mean it alert is it stops? or does it cause it to stop it if it does start? What do the stop, start, stop/start do?

Thanks

[David Claypool · Accepted solution]

The feature is intended to be used with services, not executables like calc.exe. For your testing, the easiest one that won't do any harm is probably IIS (assuming this isn't a production web server).

Open up the HP Management Agent applet, the Event Viewer MMC (Control Panel --> Administrative Tools --> Event Viewer) and also the Services MMC (Control Panel --> Administrative Tools --> Services). In the agent applet, configure "inetinfo" with the start and stop option. When you press [OK] it will restart the agents.

Once that's finished use the Services MMC to stop the process 'IIS Admin Service' and click [OK] to stop the dependent services. In the Event Viewer under System you should see the event 'Warning' with the source being the Foundation Agents. Open the event and it will say:

Foundation Agent:
Process inetinfo has stopped.
[SNMP TRAP: 11011 in CPQHOST.MIB]

If your SNMP trap destination is properly set to the HP SIM server, the event will show up there as well.

[Richard Layton_2]

I received a trap,
Event Identification and Details

Event Severity Major
Cleared Status Not cleared
Event Source stpismmsc
Associated System stpismmsc
Associated System Status Normal
Event Time Tue, 11/29/2005, 3:31:08 PM EST
Description A monitored process has either started or stopped running.
Assignee
Comments


Trap Details

Variable Description Value
NO DATA
An administratively-assigned name for this managed node. By convention, this is the node`s fully-qualified domain name. STPISMMSC
The Trap Flags. This is a collection of flags used during trap delivery. Each bit has the following meaning: Bit 5-31: RESERVED: Always 0. Bit 2-4: Trap Condition 0= Not used (for backward compatibility) 1= Condition unknown or N/A 2= Condition ok 3= Condition degraded 4= Condition failed 5-7= reserved Bit 1: Client IP address type 0= static entry 1= DHCP entry Bit 0: Agent Type 0= Server 1= Client NOTE: bit 31 is the most significant bit, bit 0 is the least significant. 0
The error message for a process monitor event. Process endpoint has started.

Mib Information
The associated MIB File Name for this trap iscpqhost.mib and the MIB identifier CPQHOST-MIB

After that the service restarted. If I select "Stop" instead of "Stop/Start" will it just alert to a stopped service and not restart it?

[Pagnotta]

Hi Richard,

There is a way to map windows events that contains a lot of serveices event to HP SIM.

For that you can use evntwin and evntcmd on your windows systems(make a seacrh on windows web site) for defining which events you want to trap. These events will be transleted to "snmp traps" send to the destinations servers you have defined in your snmp service (which you should already have if you are using HP SIM and management agents).

At this time, the snmp traps are sent over the wire to the destination server which is your HP SIM and then translated to HP SIM events. For that last thing you need to register a mib file describing the snmp traps sent in order to give the knowledge to SIM on how to map things.

I give you a mib file wrote for that purpose(based on Eric A. Hall great info on http://www.ehsco.com/reading/20050715.html)

Look at

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=977860

Hope this helps.

Angelo

[Richard Layton_2]

Thanks for the info Angelo, but that goes way past the amout of effort I want ot put toward this. We have WhatsUp Gold that can monitor the device with no rigging. I would have thought Insight could monitor service more natively without being having to resort to such things. I guess I will just have to make all service monitoring done by WhatsUp Gold.

Thanks for the info!

[Richard Layton_2]

Thanks for the info Angelo, but that goes way past the amout of effort I want to put toward this. We have WhatsUp Gold that can monitor the device with no rigging. I would have thought Insight could monitor service more natively without being having to resort to such things. I guess I will just have to make all service monitoring done by WhatsUp Gold.

Thanks for the info!

[Jim Walsh_2]

Doesnt make much sense for HP to have SIM monitor services since that is what they have the OV product line for...

[Richard Layton_2]

.