SCOM : Incorrectly reporting services running when they are not?

The Basic Service Unit Monitor is a very common monitor type to check the running status of any Windows service, but if the service is not automatic is causes the service is report as healthy when its not!!!!

 The design of this Monitor by default – is to ONLY monitor the service – if the Startup Type is set to “Automatic”

This is because many services are set to manual or disabled by design, and we don’t want to consider those as a “failed” state creating noise out of the box.  Therefore – they are ignored.

 Probably the biggest complaint about this behavior – is the UI.  Health explorer will show “Healthy” for the service monitor, EVEN if the service is not running, or doesn’t exist.  Let me explain.  If the service is set to Manual or Disabled, and not running – the monitor will initialize, ignore the service, and show healthy.  This is probably not the best behavior and it would be nice if we could control this to show warning state or unmonitored state, but that is another topic.  Additionally, if the service does not exist – the monitor will also show as healthy.  It is simply ignored.

So – to recap – the default Service Monitor will only monitor Automatic startup type services:

AutomaticRunningHealthy
AutomaticNot RunningNot Healthy
ManualRunningHealthy
ManualNot RunningHealthy
DisabledNot RunningHealthy
Does Not ExistNot RunningHealthy

The proper way to monitor a service, NO MATTER the startup type – is to OVERRIDE the Unit monitor, setting the “Alert only if service startup type is automatic” to “False”

Doing the above will now monitor the service, no matter the startup type setting…. it will ignore the startup type and only check to ensure the service is running or not.

Using the override set to false:

AutomaticRunningHealthy
AutomaticNot RunningNot Healthy
ManualRunningHealthy
ManualNot RunningNot Healthy
DisabledNot RunningNot Healthy
Does Not ExistNot RunningNot Healthy