Get notified when a service fails

, , ,

If you are a sysadmin, then you know the problem with services of vital equipment that keep failing every now and again!?  So what do you do?  Wait for the users to start calling, buy an expensive monitoring solution or just do some simple scripting?

Well I’ll just give you a quick brief on how to setup the cheap (free) scripted solution that will help keep your users happy and the services running.

I was inspired by an article at; http://www.intelliadmin.com/index.php/2010/01/get-notified-when-a-service-fails/
which was quite cool except he rely on a third party utility for mailing AND he does not relaunch the service..   I have chosen to create a VBS script that will E-Mail AND re-launch the failed service in one sweep.

Ok here goes.

  • First of all log on to the server/workstation in question (the machine where the service is running).

  • Download my vbs script here  (you may need to rightclick and choose save as)

  • Modify this part of the script in notepad with your details (smtp server, email address etc)
    script1

  • Save the file to somewhere on the C drive (I usually use “c:\windows\schedule”)

  • Now enter “Computer management” (right click on My Computer and choose “Manage”)
    commanager

  • Select the service you wish to modify/monitor and double click it

  • Modify the service as follows (you will need to modify this if you use another location for the script)
    run_a_program
    You will note that I set the script to run at the “second fail” not the first, you can set it to run at the “first fail” if you like – to avoid being bombarded I just choose first to be informed the second time a service fail.

  • The service name (described in the script) is NOT the displayname, it is the REAL name of the service, you can find this here;
    servicename

And viola you are done, from now on you will get an E-Mail every time a service has failed twice (or the first time if you prefer)..  It’s all very basic but neat.

/2 Comments/by

Recovering from a dead spooler service in windows 2003

, ,

So yesterday I had a go on restoring a dead printer spooler service, a user had tried installing a HP printer using the installation wizard on the CD and something went terribly wrong and crashed the service.

spoolerservice2The service would start but would quickly come to a halt displaying a DEP warning and you would never get anywhere near the printers.

 

 

 

 

spoolservice3I tried reinstalling Windows Server 2003 SP2 in the hope that any corrupted DLL’s etc would be refurbished but to no avail, in hindsight I should have tried SFC.EXE /Scannow (checks vital Windows files) but hindsight is often way too easy 😉

 

 

 

There was no HP Jetdirect or other suspect things to uninstall.

Then I moved to restore the printers using PrintMig (we do have backups handy for just such occations see https://readmydamnblog.com/?p=256) however as the Spooler service was not running this was impossible.

Then the time came to cleanspl.exe from the resource kit for Windows 2003 server, this was a partly success as it actually enabled the service to start – great – but as I just had clicked ‘yes’ to everything even the regular TCP/IP printing was disabled as well as ALL printers (the latter was to be expected as that is what cleanspl.exe does), ok so I tried again restoring the printers backed up with PrintMig and the problems was back the service once again could not start.
spoolservice1Examination of the eventlogs and the registry let me to believe that the culprit was the “HP Standard TCP/IP port” monitor, so after making an export of the registry, I moved to delete ALL but the LPR, Standard TCP/IP Port, USB monitor and local Port under the registry key “HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPrintMonitors”, and sure enough now the spooler service again was up and running. Now I reverted to the exported registry and then repeated the process just removing one monitor at the time, and viola once the “HP Standard TCP/IP port” was gone the service worked fine.

So here are my suggestions if you ever run into a similar problem;
1. Before this ever happens make a backup of your printers using PrintMig

2. Run SFC.EXE /Scannow just to be sure no important windows files are corrupted.

3. Check the eventlog see if you can find any references to a “monitor” name (from the; “HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPrintMonitors” registry key).

4. Make an export of the registry branch;
“HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPrintMonitors”,

5. Try to delete one sub-branch of the;
“HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPrintMonitors”,
branch at a time, after each delete try to start the spooler service.

 

A tip to prevent things like this to happen is to avoid all custom “monitors” (specially installed printer management software and ports), use regular TCP/IP and LPR ports whenever possible, sure it’s easier to install using some HP installation wizard but it is often not necessary and your windows installation will love you for not installing all that ‘crap’.

Some helpful links;

http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm

http://www.windowsreference.com/windows-xp/how-to-clean-print-spooler-in-windows-xp2003/

http://www.pcreview.co.uk/forums/thread-3490411.php

/by