Using Windows Services to Activate Triggers

You can configure a trigger to activate when the status of a Windows service changes to Stopped or Not Configured. The status Not Configured means that the service does not exist on the machine. From version 9.0.5, you can configure triggers with PowerShell cmdlets.

Prerequisites

• ControlUp version 8.8 or higher
• ControlUp Agent installed on the target machine

Step 1 - Add Services to Monitor

Before you create a trigger based on a Windows service, you must add the service to your list of monitored services. If a service is not in this list, then you can't use that service in a trigger.

To add a service:

1. In the Real-Time DX Console, go to Settings > Service Monitoring.

   

2. Click Add and enter the display name of the service that you want to use in a trigger.

   Service name vs. service display name

   The service name is different than the service display name. You need to enter the display name.

   

Step 2 - Create a Trigger

After adding a Windows service in the Service Monitoring settings, you can select the service when you configure a trigger.

1. Create an Advanced trigger type and set the record type to Service.

   

2. Use the filter editor to set the Windows service and status that causes the trigger to activate. In this example, the trigger activates when the Print Spooler service is stopped on a machine.

   

For more details on creating a trigger, visit Setting up Triggers.

Use Case Example - Send a Webhook When A Service Stops Running

To use a webhook or an email notification as a trigger follow-up action, you need to create a notification template. Three new variables have been added to use for services:

• $(servicename)
• $(servicestatus)
• $(servicecompname)

In this example, we create a trigger that activates when the Print Spooler service stops running.

For the trigger follow-up action, we configure a webhook follow-up action and use this notification template:

{
  "Organization Name": "$(OrgName)",
  "Folder Name": "$(CUFolderName)",
  "Reported By": "$(ReportedBy)",
  "Trigger Name": "$(TriggerName)",
  "Computer Name": "$(CompName)",
  "Service Name": "$(servicename)",
  "Service State": "$(servicestatus)",
  "Service Computer Name": "$(servicecompname)",
  "Resource Type": "$(ResourceType)",
  "Stress Level": "Advanced",
  "Incident Timestamp": "$(Timestamp)",
}

When the Print Spooler service stops running on a machine, the trigger activates and sends the following webhook: