Monitoring a service that runs as svchost with nagios

Question

What was IAS in Server 03 is now Network Policy Server (NPS) in Server 08. I was able to monitor the service in 03, but have been unsuccessful in figuring out how to in 08. The path to executable states the following "C:\Windows\System32\svchost.exe -k netsvcs"

I have tried multiple commands but have been unable to find one that works.

check_nt!PROCSTATE!-d SHOWALL svchost.exe -k netsvcs

check_nt!PROCSTATE!-d SHOWALL netsvcs.exe

score 2 · Accepted Answer · answered Oct 01 '09 at 21:39

SVCHOST.EXE is a generic host process used to run those services that are compiled as DLLs instead of being standalone executables; there are usually various instances of SVCHOST.EXE running in a Windows system, each one hosting multiple services.

You can't monitor such a service based only on the executable name.

I for myself don't know Nagios at all, but I think this article should help you, especially with this example:

define service{
    use                     generic-service
    host_name               winserver
    service_description     W3SVC
    check_command           check_nt!SERVICESTATE!-d SHOWALL -l W3SVC
    }

It's using SERVICESTATE instead of PROCSTATE, and looks like it recognizes Windows Service names: W3SVC is the short name of the World Wide Web Publishing Service; you should be able to replace it with the short name for the NPS service and monitor that one, too.

P.S. The article is the first result generated by putting "nagios windows service" in Google; that's how I found it.

After doing multiple checks servicesstate is the way to go. Procstate is what I was attempting to use because it was referenced many times on the nagios forums. — IOTAMAN, Jan 12 '10 at 15:06

score 1 · Answer 2 · answered Oct 03 '09 at 02:59

1

I found a workaround, monitoring iashost.exe is equivalent to monitoring NPS. So I simply used:

check_nt!PROCSTATE!-d SHOWALL -l iashost.exe

Thanks Massimo for the suggestion but I had already referenced that page.

answered Oct 03 '09 at 02:59

IOTAMAN

665
2
8
13

I'm curious: why are you so fond on using PROCSTATE instead of SERVICESTATE, which exists exactly for monitoring Windows Services? – Massimo Oct 04 '09 at 14:56

Monitoring a service that runs as svchost with nagios

2 Answers2