Guides‎ > ‎Common Checks‎ > ‎

Services

Service Is Started

Check to make sure a service is started. Critical alert if service is stopped.

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c CheckServiceState -a ShowAll Spooler

Output If Service Is Started:
OK: Spooler: started

Output If Service Is Stopped:
CRITICAL: Spooler: stopped (critical)


NSClient++
0.4.3.131 onwards
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c check_service -a 'service=spooler'

Output If Service Is Started:
OK: All 1 service(s) are ok.

Output If Service Is Stopped:
CRITICAL: spooler=stopped (auto), delayed ()

Service Is Stopped

Check to make sure a service is stopped. Critical alert if service is started.

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c CheckServiceState -a ShowAll Spooler=stopped

Output If Service Is Started:
CRITICAL: Spooler: started (critical)

Output If Service Is Stopped:
OK: Spooler: stopped


NSClient++ 0.4.3.131 onwards
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c check_service -a 'service=spooler' "ok= state = 'stopped'" "warning=not state = 'stopped'" "critical=not state = 'stopped'" "perf-config=*(ignored:true)"

Output If Service Is Started:
CRITICAL: spooler=running (auto), delayed ()|

Output If Service Is Stopped:
OK: All 1 service(s) are ok.|

Service With $ Character

Services like MSSQL$SQLEXPRESS require the $ character to be escaped so it is sent as plain text.

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c CheckServiceState -a ShowAll MSSQL\$SQLEXPRESS

Output If Service Is Started:
OK: MSSQL$SQLEXPRESS: running

Output If Service Is Stopped:
CRITICAL: MSSQL$SQLEXPRESS: stopped

NOTE: In your nagios service configuration it may need to be defined with 2 $ signs like:
MSSQL\$$SQLEXPRESS

NSClient++ 0.4.3.131 onwards
No additional configuration is required.
NOTE: you don't need to escape the $ sign in this example.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c check_service -a 'service=MSSQLFDLauncher$UWCX01'

Output If Service Is Started:
OK: All 1 service(s) are ok.|

Output If Service Is Stopped:
CRITICAL: MSSQLFDLauncher$UWCX01=stopped (auto), delayed ()|

Service With () Characters

Services like GxEvMgrC(Instance001) require the () characters to be escaped so they are sent as plain text.

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c CheckServiceState -a ShowAll GxEvMgrC\(Instance001\)

Output If Service Is Started:
OK: GxEvMgrC(Instance001): started

Output If Service Is Stopped:
CRITICAL: GxEvMgrC(Instance001): stopped (critical)

NSClient++ 0.4.3.131 onwards
No additional configuration is required.
NOTE: you don't need to escape the ( brackets ) in this example.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c check_service -a 'service=GxEvMgrC(Instance001)'

Output If Service Is Started:
OK: All 1 service(s) are ok.|

Output If Service Is Stopped:
CRITICAL: GxEvMgrC(Instance001)=stopped (auto), delayed ()|

Check All

Check to make sure all services set to auto-start are started and all set to disabled are not started.

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c CheckServiceState -a ShowAll CheckAll

Output If All Are OK:
OK: AudioEndpointBuilder: started, AudioSrv: started, BFE: started, CryptSvc: started, CscService: started, DcomLaunch: started, Dhcp: started, Dnscache: started, DPS: started, eventlog: started, EventSystem: started, FDResPub: started, gpsvc: started, iphlpsvc: started, LanmanServer: started, LanmanWorkstation: started, lmhosts: started, Mcx2Svc: stopped, MMCSS: started, MpsSvc: started, NetTcpPortSharing: stopped, NlaSvc: started, nsi: started, PcaSvc: started, PlugPlay: started, Power: started, ProfSvc: started, RemoteAccess: stopped, RpcEptMapper: started, RpcSs: started, SamSs: started, Schedule: started, SENS: started, SharedAccess: stopped, ShellHWDetection: started, Spooler: started, SysMain: started, Themes: started, TrkWks: started, UxSms: started, VMTools: started, Winmgmt: started

Output If A Service Is Stopped:
CRITICAL: AudioEndpointBuilder: started, AudioSrv: started, BFE: started, CryptSvc: started, CscService: started, DcomLaunch: started, Dhcp: started, Dnscache: started, DPS: started, eventlog: started, EventSystem: started, FDResPub: started, gpsvc: started, iphlpsvc: started, LanmanServer: started, LanmanWorkstation: started, lmhosts: started, Mcx2Svc: stopped, MMCSS: started, MpsSvc: started, NetTcpPortSharing: stopped, NlaSvc: started, nsi: started, PcaSvc: started, PlugPlay: started, Power: started, ProfSvc: started, RemoteAccess: stopped, RpcEptMapper: started, RpcSs: started, SamSs: started, Schedule: started, SENS: started, SharedAccess: stopped, ShellHWDetection: started, Spooler: stopped (critical), SysMain: started, Themes: started, TrkWks: started, UxSms: started, VMTools: started, Winmgmt: started

NSClient++ 0.4.3.131 onwards
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c check_service

Output If All Are OK:
OK: All 147 service(s) are ok.

Output If A Service Is Stopped:
CRITICAL: Spooler=stopped (auto), delayed ()

Output If An "Automatic (Delayed Start)" Service Is Stopped:
WARNING: , delayed (clr_optimization_v4.0.30319_32=stopped (delayed), clr_optimization_v4.0.30319_64=stopped (delayed))

Check All With Exclude

Check to make sure all services set to auto-start are started and all set to disabled are not started. Exclude the Spooler service.

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c CheckServiceState -a ShowAll CheckAll exclude=Spooler

Output When Spooler Sevice Is Stopped:
OK: AudioEndpointBuilder: started, AudioSrv: started, BFE: started, CryptSvc: started, CscService: started, DcomLaunch: started, Dhcp: started, Dnscache: started, DPS: started, eventlog: started, EventSystem: started, FDResPub: started, gpsvc: started, iphlpsvc: started, LanmanServer: started, LanmanWorkstation: started, lmhosts: started, Mcx2Svc: stopped, MMCSS: started, MpsSvc: started, NetTcpPortSharing: stopped, NlaSvc: started, nsi: started, PcaSvc: started, PlugPlay: started, Power: started, ProfSvc: started, RemoteAccess: stopped, RpcEptMapper: started, RpcSs: started, SamSs: started, Schedule: started, SENS: started, SharedAccess: stopped, ShellHWDetection: started, SysMain: started, Themes: started, TrkWks: started, UxSms: started, VMTools: started, Winmgmt: started


NSClient++ 0.4.3.131 onwards
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c check_service -a exclude=Spooler

Output If All Are OK:
OK: All 144 service(s) are ok.|

Output If A Service Is Stopped:
CRITICAL: RemoteRegistry=stopped (auto), delayed ()|


Exclude the "Microsoft .NET Framework Services that are stopped but are configured as "Automatic (Delayed Start)", being stopped is normal for these.

NSClient++ 0.4.3.131 onwards
No additional configuration is required.
Command:
check_nrpe -H 192.168.142.137 -t 30 -c check_service -a "filter=name not like 'clr_optimization_v4.0.30319'"

Output If All Are OK:
OK: All 145 service(s) are ok.|

Output If A Service Is Stopped:
CRITICAL: Spooler=stopped (auto), delayed ()|