banshee/windows-collection/windows/snmp/
services
The started services of a Windows and their state, by SNMP
by banshee1 installation2 versions
Services of a Windows, by SNMP
Returns the state of each started service of a Windows: active, paused, or between the two. Two watches are proposed, each one set on the probe: the service that should run and does not, and the service that is not active.
How it works
The collector reads the table svSvcTable of LanMgr-Mib-II (1.3.6.1.4.1.77): svSvcName (1.3.6.1.4.1.77.1.2.3.1.1) and svSvcOperatingState (1.3.6.1.4.1.77.1.2.3.1.3).
- The state is returned in words:
active(1),continue-pending(2),pause-pending(3),paused(4); any other value isunknown. - Windows lists only the started services in that table: a stopped service disappears from it. A stopped service is therefore seen by its absence, through the watch "Service stopped", on the names it is given.
- The name of a service is its display name, in the language of the system:
Windows Event Logon an English Windows,Journal d'événements Windowson a French one. - Nothing is skipped at the first run.
- The selection is limited to
Windows Event Log: a Windows runs dozens of services. Add on the probe the display names of the services to follow, in the language of the system.
Nothing is written to the Windows: SNMP reads only.
Prerequisites
- The SNMP service of Windows, installed and started: - on Windows Server, the feature "SNMP Service" (Server Manager, Add Roles and Features; or
Install-WindowsFeature SNMP-Servicein PowerShell); - on Windows 10 and 11, the optional feature "Simple Network Management Protocol (SNMP)" (Settings, Optional features; orAdd-WindowsCapability -Online -Name SNMP.Client~~~~0.0.1.0in PowerShell). - In the properties of the service "SNMP Service", tab Security: - a community with the right READ ONLY, which banshee reads in
protocol:snmp:v2c:community; - under "Accept SNMP packets from these hosts", the address of the poller. - SNMPv3: the SNMP agent of Windows does not offer it;
protocol:snmp:versionstaysv2c. The community then travels in clear text: keep it read-only and accepted from the poller alone. - The Windows firewall open to the poller on UDP 161 (the rule "SNMP Service (UDP In)").
Outputs
| Name | Label | Unit | Per instance |
|---|---|---|---|
state | State | — | yes, per service |
Watches
| Name | Title | Kind | Defaults | Checked by default |
|---|---|---|---|---|
stopped | Service stopped | expected instances, on state | no service named: it raises nothing until names are set on the probe | yes |
not-active | Service paused or in transition | expected value, on state | warning when the state is anything but active; no critical | yes |
"Service stopped" names no service by default: a name written in English would raise wrongly on a Windows in another language. It looks at every service returned, inside the selection or not.
Limits
- A stopped service and a service that does not exist look the same: both are absent from the table.
- The start type of a service (automatic, manual, disabled) is not served: "a service set to start automatically that is stopped" cannot be judged here; name the services that must run.
- Not yet checked on a real Windows: the encoding of a display name outside ASCII. A Windows in another language may serve it in a code page rather than UTF-8; a name with an accent may then not match the one written on the probe.