banshee/windows-collection/windows/snmp/
services
The started services of a Windows and their state, by SNMP
by banshee1 installation2 versions
v2Latest
Published on October 28, 2026. One naming convention across collections; documentation completed.
Services of a Windows, by SNMP
Returns the state of each started service of a Windows: active, paused, or between the two. Two watches are proposed, each one set on the probe: the service that should run and does not, and the service that is not active.
Versions
Generic: written for the SNMP agent of Windows, the feature "SNMP Service" of Windows Server or the optional feature of Windows 10 and 11, and for LanMgr-Mib-II, which it serves. That every release of Windows serves it alike is assumed, not yet checked on a real Windows.
How it works
The collector reads the table svSvcTable of LanMgr-Mib-II (1.3.6.1.4.1.77): svSvcName (1.3.6.1.4.1.77.1.2.3.1.1) and svSvcOperatingState (1.3.6.1.4.1.77.1.2.3.1.3).
- The state is returned in words:
active(1),continue-pending(2),pause-pending(3),paused(4); any other value isunknown. - Windows lists only the started services in that table: a stopped service disappears from it. A stopped service is therefore seen by its absence, through the watch "Service stopped", on the names it is given.
- The name of a service is its display name, in the language of the system:
Windows Event Logon an English Windows,Journal d'événements Windowson a French one. - Nothing is skipped at the first run.
- The selection is every started service by default.
- The SNMP service that answers is itself a started service, so the table is never empty on a Windows that serves it: a table from which no service is read (empty, or no row with both a name and a state) stops the collector
misconfigured, with "The agent does not serve the service table".
Nothing is written to the Windows: SNMP reads only.
Prerequisites
- The SNMP service of Windows, installed and started: - on Windows Server, the feature "SNMP Service" (Server Manager, Add Roles and Features; or
Install-WindowsFeature SNMP-Servicein PowerShell); - on Windows 10 and 11, the optional feature "Simple Network Management Protocol (SNMP)" (Settings, Optional features; orAdd-WindowsCapability -Online -Name SNMP.Client~~~~0.0.1.0in PowerShell). - In the properties of the service "SNMP Service", tab Security: - a community with the right READ ONLY, which banshee reads in
protocol:snmp:v2c:community; - under "Accept SNMP packets from these hosts", the address of the poller. - SNMPv3: the SNMP agent of Windows does not offer it;
protocol:snmp:versionstaysv2c. The community then travels in clear text: keep it read-only and accepted from the poller alone. - The Windows firewall open to the poller on UDP 161 (the rule "SNMP Service (UDP In)").
Outputs
| Name | Label | Unit | Per instance |
|---|---|---|---|
state | State | — | yes, per service |
Watches
| Name | Title | Kind | Defaults | Checked by default |
|---|---|---|---|---|
stopped | Service stopped | expected instances, on state | critical when Windows Event Log is absent | yes |
not-active | Service paused or in transition | expected value, on state | warning when the state is anything but active; no critical | yes |
"Service stopped" looks at every service returned, inside the selection or not. Add on the probe, under critical, the display names of the other services that must run.
On a Windows in another language, the probe is red until "Service stopped" is set. The default name, Windows Event Log, is the English display name of the event log: a French Windows calls it Journal d'événements Windows, so the English name reads absent and raises critical. That red is meant: a default that named no service would stay green on a stopped service, and nobody would see it. To set it, replace Windows Event Log under critical with the display name the Windows gives, read in the Services console (column Name) or by (Get-Service EventLog).DisplayName in PowerShell.
Limits
- A stopped service and a service that does not exist look the same: both are absent from the table.
- The start type of a service (automatic, manual, disabled) is not served: "a service set to start automatically that is stopped" cannot be judged here; name the services that must run.
- Not yet checked on a real Windows: the encoding of a display name outside ASCII. A Windows in another language may serve it in a code page rather than UTF-8; a name with an accent may then not match the one written on the probe.