Using SCOM to Automatically Stop MOM Agent Service

I’m currently working on a MOM 2005-to-SCOM 2007 migration project for a client. after months of work, we are finally ready to stop MOM service.

We created a new GPO to set MOM service (MOM agent) to “Disabled” and linked to the top of the domain. we also wanted to make sure all MOM service are actually STOPPED on domain member servers AS WELL AS standalone SCOM agents. Traditionally, I’d create a package in SMS/SCCM with a script that firstly detect if SCOM agent service (HealthService) is running, and secondly, if so, stop MOM service. However, this particular client I’m currently working for does not have SCCM infrastructure for their servers. I didn’t want to run a script to go out stop the MOM service on all servers because there are firewalls located in different segments of the network and running a script does not ENFORCE this setting…

To achieve my objective, I have created a basic service unit monitor in SCOM to detect the status of MOM service and created a recovery task for this monitor. The monitor generates an alert if MOM service is running and Recovery task will be executed to stop MOM service!

Below is what I’ve done:

1. Create a basic service monitor targeting Windows Operating System:

This monitor is targeting MOM service

If the service is NOT running, the health state is considered as healthy, otherwise, it is in warning state

We only subscribe to critical and warning alerts, I didn’t want get too much attention so I configured the alert severity to only Information:

Lastly, I created a diagnostic and a recovery task associated to this monitor.

The Diagnostic task is simply checking the state of MOM service:

And the recovery task stops MOM service:

So now the monitor is created. note from the first screen shot, I did not enable this monitor. I wanted to test it first! So I created an override to only enable it to a particular Windows 2003 server.

After few minutes, I could see the health state change in Health Explorer:

1 minute after the health state changed from Healthy to Warning, it changed back to Healthy – because the recovery task kicked in and stopped MOM service. Below are the results from Diagnostic and Recovery Tasks:

Diagnostic Task:

Recovery Task:

And now, the alert is automatically closed:

I logged on to the target server, checked MOM service, it is stopped:

Now, I can go ahead and enable this monitor!

One comment

  1. Hello,
    I noticed this is working fine when the service exist but if it does not exist it is giving an error on the diagnostics:

    [SC] EnumQueryServicesStatus:OpenService FAILED 1060:
    The specified service does not exist as an installed service.

    and also on the recovery

    System error 1060 has occurred.
    The specified service does not exist as an installed service.

    which ends by showing an informational message “MOM Service is still running” in the console…which is not expected as if the service does not exist it should ignore the tasks… isn’t it?

    Any idea why?
    Thanks,
    Dom

Leave a Reply

%d bloggers like this: