That is using the service monitor template.  Using that template creates a new class, with a discovery to populate that class instances (computers running the service), and then creates a unit monitor for service running, AND additional self-tuning threshold monitors, and perf signature collection rules.  This template wizard creates a LOT more workflows than a simple unit monitor.

Those self-tuning threshold monitors are often very noisy, and not actionable.  I can’t stand them, personally, to be used as a default.  That said – I am not a huge fan of using the service monitor template at all.  I would much rather target a generic class (Windows Server Operating System) and then only create a single unit monitor for service running status.

An alternative – is to create a new class that defines my application, and then target my unit monitor to that new custom class.

I agree with your synopsis – override the self tuning threshold monitors…. Or better yet – disable them.  Don’t forget to disable perf-signature collection rules if you turn off the monitors as well.

The new R2 wizard is MUCH cooler – it still creates a class – but instead of any self-tuning monitors – it creates optional static threshold monitors for CPU and memory only.

One thing we have seen when using Windows Service Monitors that were generated using the wizard is after 2 weeks the performance issue alerts will start firing off. By default the performance monitors are setup to learn your service's performance characteristics, and then setup thresholds based on that. As a result alerts start firing off whenever your service is used.

If you deleted and recreated the monitor you will probably see these alerts startup again in 2 weeks. You either need to override the performance thresholds for these monitors or remove them.

From: admin@lists.myITforum.com [mailto:admin@lists.myITforum.com] On Behalf Of Kevin Holman
Sent: Tuesday, August 25, 2009 11:17 AM
To: msmom@lists.myitforum.com
Subject: [msmom] RE: False positives for Windows Service Monitors

What is a “false positive”?  You mean you get an alert saying a service is “not running”, and health explorer also shows this state change history, however – the service was truly never down?

I have not seen that.

We have recently seen a lot of False positives for Windows Service Monitors. Has anyone else seen a lot of false positives for Windows Service Monitors? Any fix for these? It seems before after deleting the monitor and recreating it has helped alleviate the issue.

_______________________________________________________________________________

David Strebel

Systems Administrator

Kellogg Information Systems

Kellogg School of Management

847-467-7803

d-strebel@kellogg.northwestern.edu

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/momlist/

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/momlist/

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/momlist/

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/momlist/