SCOM 2012 – Recovery Task Script for Restarting a Windows Service and Depending Services

A while ago there was an issue at a customers side where I had to provide a solution for restarting a Windows service depending on a Windows event log entry. Well this is nothing special and we SCOM guys do it almost every day. The fun part was, that it was a custom service and this custom service contained several depending services. The goal was to restart the main service in that way that the depending services had the same running state as they had before the main service was restarted.

An example, the service SvcMain (startup type “manual”, status = “running”)  has two depending services SvcSub1 (startup type “manual”, status = “running”) and SvcSub2 (startup type “manual”, status = “stopped”) .

Now a Windows event occurs (e.g. Event ID 1234) the recovery task should trigger and should restart the SvcMain and its depending services SvcSub1 and SvcSub2 in a way that they have the same running status as before. That means SvcMain must be running, SvcSub1 has to be started and SvcSub2 has to be stopped.

To visualize what I mean by depending services let’s have a look at the “DHCP Client” service…

image

has the following depending services “Network Location Awarness” and “WinHTTP Web Proxy Auto Discovery Service”…

image

Everything o.k.? So, I thought I will make this script available for you guys.

Let’s first start with the event monitor…

Create Event Monitor

Start the the wizard for a manual reset event monitor…

image

Give it a name and choose an appropriate class…

image

Choose the event log in my case “Application”…

image

Set the “Event ID” and “Event Source” you are looking for…

image

Select how the health state of the monitor should appear…

image

Choose if you want to receive an alert or not…

image

Recovery Task

Search for the monitor and modify on the “Diagnostic and Recovery” tab under the “Configure recovery tasks” section by clicking “Add…”…

image

Choose “Run Script”…

image

Enter a name and click “Next”…

image

Set the “File Name” for the script (any name is possible, just make sure you set a *.vbs extension) then click “Edit in full screen…”

image

and copy/paste this script here. Make sure you define the service name of the Windows service which you want to restart in the script file…

image

Click create and close all windows…

image

Well that’s it. Next time if your specified event occurs, the recovery task will be triggered and your services will be restarted.

Script download

Have fun…

19 Comments

  1. Hello do you know if there is a way to run a report on how many times the auto recovery task ran? If I target a windows service and set it to auto resolve how can I tell how many times the service was auto resolved

  2. Hello,

    When completing this custom recovery task, I am getting the following error.

    Date: 2013-04-22 12:50:52 PM
    Application: Operations Manager
    Application Version: 7.0.9538.0
    Severity: Error
    Message:

    : Verification failed with 1 errors:
    ——————————————————-
    Error 1:
    Found error in 1|SystemCenterCustomMP|1.0.0.0|MomUIGenaratedRecovery08551b16474047acaaa6bc11326e83e4|| with message:
    Target class Microsoft.Windows.Computer for Recovery MomUIGenaratedRecovery08551b16474047acaaa6bc11326e83e4 does not derive from Target class Microsoft.Windows.Server.Computer of the monitor (UIGeneratedMonitoraf180643cbd341f9bd053b0cc50b2c80) that this recovery is assigned to.
    ——————————————————-

    : Target class Microsoft.Windows.Computer for Recovery MomUIGenaratedRecovery08551b16474047acaaa6bc11326e83e4 does not derive from Target class Microsoft.Windows.Server.Computer of the monitor (UIGeneratedMonitoraf180643cbd341f9bd053b0cc50b2c80) that this recovery is assigned to.

  3. Is the command to run for the recovery located on the server that triggers the error condition or on the scom servers. And does it run it locally on the scom server or on the server that has the error?

  4. Hi Stefan;
    Thanks for Great article.
    I configured the Monitor in SCOM to monitor a log file for modified time is <10 minutes else generate alert. which works fine.
    Also configured recovery task to restart the application service and wrote a vb script for the same. Script work fine when run it with elevated privilege but on normal CMD prompt it give access denied error.
    I am not sure SCOM 2012 R2 will run recovery task script under elevated privilege or not. As my recovery script is not running successfully.( Service suppose to restart does not)
    Also where I can find the logs to check if recovery task run properly in SCOM.

    regards;
    Nilesh Gavali.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s