Home » System Center Operations Manager 2007 » Restart a service, and keep an eye on it


Welcome to contoso.se! My name is Anders Bengtsson and this is my blog about Azure infrastructure and system management. I am a senior engineer in the FastTrack for Azure team, part of Azure Engineering, at Microsoft.  Contoso.se has two main purposes, first as a platform to share information with the community and the second as a notebook for myself.

Everything you read here is my own personal opinion and any code is provided "AS-IS" with no warranties.

Anders Bengtsson

MVP awarded 2007,2008,2009,2010

My Books
Service Manager Unleashed
Service Manager Unleashed
Orchestrator Unleashed
Orchestrator 2012 Unleashed
Inside the Microsoft Operations Management Suite

Restart a service, and keep an eye on it

You can use a basic service monitor to restart, but even if Ops Mgr restarts the service automatic you need to keep an eye on it. You don’t want Operations Manager to restart the service every two minute, if it does, you need to get notified and investigate the root cause. To keep an eye on this your can use a repeated event detection monitor, that will generate an alert if the service is restarted to often. In this example I will create a monitor to monitor the print spooler (spooler) service and restart it if needed. I will also create a monitor to look at “the print spooler service entered the running state” events. If there are more then four events within one hour Operations Manager will generate an alert.

1. Authoring > Monitors > New Monitor > Windows Services > Basic Service Monitor
2. General: Name, Description and target for example Windows Server 2008 Computer
3. Service Details: spooler
4. Configure Health: Next
5. Configure Alerts: Check generate alerts for this monitor, Create
6. Right-click the new monitor and select properties from the context menu
7. Click the Diagnostic and Recovery tab
8. Add a recovery task that (make sure to get the recovery target correct)
– Recalculate monitor state after recovery finishes
– Run a command
– Full path to file: C:\Windows\System32\cmd.exe
– Parameters: /C net start spooler
9. Create, Ok

… next step is create a monitor that will keep track service restarts

1. Authoring > Monitors > New Monitor > Windows Events > Repeated Event Detection
2. General: Name, Description and target for example Windows Server 2008 Computer
3. Event Log Name: System
-Event Expression:
-Event ID: 7036
-Event Level: Information
– EventDescription contains Spooler
– EventDescription contains running
4. Repeat Settings:
– Counting mode, trigger on count sliding, compare count 4
– based on items occurrence within a time interval, interval 1, hours
5. Configure Health: Next
6. Configure Alerts: Check generate alerts for this monitor, Create


  1. Hi thanks for the info i have a question .

    Is it possible to delay the restart for 10 minutes after the monitor is trigged??


  2. Hi, thanks for the info. We have been using Service Protector here, to make sure that our services never stop running, but this is more generalized.

Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.