How to run a service monitor during business hours

Based on the feedback I received I go on with this sequence of posts about monitoring during business hours. As we’ll see implementing this kind of monitor for a service it’s quite cumbersome, so once again my advice, remember in many cases you can live without this feature:

  1. you can specify business hours in reporting
  2. you can suppress rule based alerts raised during non BH
  3. you can schedule maintenance for the object, even if there’s some drawback with it (see my future post “The nasty side of maintenance mode”)
  4. you can avoid receiving alerts message tuning your subscriptions

Having said that, let’s go to work.

Creating a service monitor from UI creates a simple discovery rule for the named service; the discovered object class is Microsoft.SystemCenter.OwnProcessNTService. This class inherits several monitors and rules, just to name a few:

  • Microsoft.SystemCenter.NTService.OwnProcess.HandleCountMonitor
  • Microsoft.SystemCenter.NTService.ServiceStateMonitor
  • Microsoft.SystemCenter.NTService.OwnProcess.PercentProcessorTimeMonitor
  • Microsoft.SystemCenter.NTService.OwnProcess.ThreadCountMonitor
  • Microsoft.SystemCenter.NTService.OwnProcess.WorkingSetMonitor

All these monitros are based on the following Monitor Types:

  • Microsoft.Windows.CheckNTServiceStateMonitorType
  • Microsoft.SystemCenter.NTService.TwoStateBaseliningMonitorType

These types are in turn based on the following data sources:

  • Microsoft.Windows.Win32ServiceInformationProvider
  • Microsoft.SystemCenter.NTService.FilteredWin32ServiceInformationProvider this one in turns is based on the Microsoft.Windows.Win32ServiceInformationProvider

So what we have here is a chain that leads to the Win32ServiceInformationProvider, what we need to do is rewrite the monitors (yes, we need to disable the standard ones and create our owns) so that the DataSource is invoked just during BH. But here we have a few problems:

  • The Win32ServiceInformationProvider just accept a frequency in its config manifest and it’s native. This mean we don’t have a composition we can filter with a scheduler
  • DataSources are supposed to be the first module in a composition (see since they do not have any input stream and probably we do not want the monitor to run altogether during non BH

Digging into the Microsoft.SystemCenter.NTService.Library MP we can find we have a companion probe Microsoft.Windows.Win32ServiceInformationProbe. This is what we need, this way we can build a composite module combining: scheduler -> scheduler filter -> probe.

By now we have all the components required to build the new monitor types, for example sake let’s concentrate on the CheckNTServiceStateMonitorType. The original one has the following composition: Win32ServiceInformationProvider every 60 seconds. We will change it to have the following: System.Scheduler -> System.SchedulerFilter -> Windows.Win32ServiceInformationProbe.

Obviously I could have had a different approach: let’s run the check but filter out the result during non BH. In this case my composition would have been Win32ServiceInformationProvider -> System.SchedulerFilter.

I attach a simple MP in which I add the monitor to a specific UI generated service monitor. In the MP you can find both strategies: Progel.NTService.ServiceStateMonitor1 uses the first approach using a scheduler and the a filter, Progel.NTService.ServiceStateMonitor2 just filters out result from the DS. The main difference between the two is the second one always run the service check and just filters out the resulting stream, the first one runs the service check only during BH. Since both modules are native it’s difficult to say which is the best approach on a performance point of view. Imo the first approach makes more sense on this respect.

Please use it just as an example it lacks some polishing (read configurable parameters, display strings, etc.)

Now the question is: is it worth?

  1. #1 by Chris Temple on May 2, 2014 - 5:00 pm

    Link to XML file in article is not working (Skydrive)

    • #2 by Daniele Grandini on May 3, 2014 - 9:21 am

      HI Chris,
      thanks to let me know, now the link should work.

  2. #3 by Srini on July 27, 2009 - 11:06 am

    We have a SCOM monitor that runs a VB script which in-turn executes a stored procedure. This monitor is of type TimedScript.TwostateMonitorType which runs the vb script once in every one hour.

    However, we do not want this script to be run in the evening for three hours while the related databases are backed up. Your blog did give me some idea but, I am unable to proceed much. Have got an example of such script ? Is so, please post it.



    • #4 by Daniele Grandini on August 3, 2009 - 12:03 pm

      Hi Srini,
      if you want to use the TimedScript.TwostateMonitorType you’re out of luck, or you need to implement the businss hour logic in your script. Basically you can test for the running hour inside your script and in that case you can skip the stored procedure execution and return an OK status. Alternatively you need to build your monitor using composition, I would suggest the following posts: here you can see how to add a scheduler filter to your monitor using authoring console here you have an example for a service monitor that you can easily adapt for your script, just remember you need to encapsulate the script in a script datasource and then create a monitor type where you add a scheduler filter to the composition


      • #5 by Srini on August 3, 2009 - 12:14 pm

        Thanks for your time.

        I have already looked at both the option you suggested.

        We are not currently using authoring console R2, the first option was ruled out. Hence, I did already write this monitor using composition, similar to one mentioned in sample MP attached to the article – the approach is similar to one you suggested. I have not yet finsihed testing it though. I shall post the result here.



  1. OPSMGR 2007 + Web Application monitor | keyongtech

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Get every new post delivered to your Inbox.

Join 500 other followers

%d bloggers like this: