Home / server / Questions / 70564
Accepted
IOTAMAN
Asked: 2009-10-02 13:20:03 +0800 CST

Monitoring a service that runs as svchost with nagios

  • 772

What was IAS in Server 03 is now Network Policy Server (NPS) in Server 08. I was able to monitor the service in 03, but have been unsuccessful in figuring out how to in 08. The path to executable states the following "C:\Windows\System32\svchost.exe -k netsvcs"

I have tried multiple commands but have been unable to find one that works.

check_nt!PROCSTATE!-d SHOWALL svchost.exe -k netsvcs

check_nt!PROCSTATE!-d SHOWALL netsvcs.exe

windows-server-2003

2 Answers

  1. Best Answer

    SVCHOST.EXE is a generic host process used to run those services that are compiled as DLLs instead of being standalone executables; there are usually various instances of SVCHOST.EXE running in a Windows system, each one hosting multiple services.

    You can't monitor such a service based only on the executable name.

    I for myself don't know Nagios at all, but I think this article should help you, especially with this example:

    define service{
    use                     generic-service
    host_name               winserver
    service_description     W3SVC
    check_command           check_nt!SERVICESTATE!-d SHOWALL -l W3SVC
    }

    It's using SERVICESTATE instead of PROCSTATE, and looks like it recognizes Windows Service names: W3SVC is the short name of the World Wide Web Publishing Service; you should be able to replace it with the short name for the NPS service and monitor that one, too.

    P.S. The article is the first result generated by putting "nagios windows service" in Google; that's how I found it.

    • 2

  2. I found a workaround, monitoring iashost.exe is equivalent to monitoring NPS. So I simply used:

    check_nt!PROCSTATE!-d SHOWALL -l iashost.exe

    Thanks Massimo for the suggestion but I had already referenced that page.

    • 1