SVCMON v0.8 - NT Service Monitor Perl Script
README file
 

1. Introduction
2. Installation
3. Configuration
4. Monitoring multiple services
5. NT Resource Kit tools
6. Limitations
7. Possible Enhancements
8. Licensing
9. Contact Information

1. Introduction

This document describes a Perl script (SVCMON) and associated files whose purpose is to monitor and  automatically restart an NT service. It is intended to be used by system administrators, not end users.

In many NT environments, critical functions are performed by programs called "services". These are roughly equivalent to daemons in a unix environment, in that they run at in the background, are usually started at boot time, and have no keyboard/video user interaction. 

In the unix world, many daemons are started by the init process, which watches over them and will restart them if they stop. There is no equivalent in NT.

This is a serious problem in many NT environments, because some services have a nasty habit of either crashing (equivalent of a core dump) or simply stopping. Often there are no event log or logfile entries to provide clues as to why the service stopped. Administrators only find out when help desk calls start coming in. Many administrators just restart the service and hope it doesn't stop again too soon.

The SVCMON script addresses these problems at two levels. First, it monitors a service and will send an E-mail notification if the service stops. Second, it will try to restart the service automatically, with no administrator intervention.

The service monitor distribution includes the following files:

README.DOC - this readme file
SVCMON.PL - service monitor script
SVCMON.EXE - compiled .EXE version (no Perl interpreter required!)
SVCMON.CONF - sample configuration file
SVCLIST.PL - helpful script to list installed NT services
SVCLIST.EXE - compiled .EXE version
INSTSRV.EXE - service installation program from NT Resource Kit
SRVANY.EXE - program to run any .EXE as a service, from NT Resource Kit 
GPL.TXT - GNU General Public License

SVCMON is distributed in both original Perl source and compiled .EXE form. The advantage of using the EXE version is that you do not need to have Perl installed on the NT server at all. The disadvantage is that you cannot edit the script to adjust it for your environment. The compilation of the Perl script was done using the perl2exe package at http://www.demobuilder.com/perl2exe.htm.

SVCMON works by using Win32 Perl extensions to get a list of services, check the status of a service, and restart a service. It also sends SMTP mail to a specified address to alert you when a service has stopped.

2. Installation

The installation is slightly different depending on whether you are using the precompiled version or the original script. The basic approach is to create a new service definition with INSTSRV.EXE, indicating SRVANY.EXE as the program to run. Then various registry entries are made to configure SRVANY to run the specific program, either A) the precompiled SVCMON.EXE or B) the Perl interpreter with SVCMON.PL as a parameter.

Here are the installation steps for using the precompiled script:

1. Log in as the local Administrator.

2. Make a new directory for the service monitor files, such as C:\SERVICE-MONITOR.

3. Unpack the distribution ZIP file into the new directory.

4. Open up a command prompt, and cd to that directory.

5. Run INSTSRV.EXE to create the registry entries for a new service. You can call it whatever you want, in this example we use "WebMon":
C:> INSTSRV  WebMon  C:\SERVICE-MONITOR\SRVANY.EXE

6. Start the registry editor (Start->Run->REGEDT32).

7. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

8. You should see an entry for the new service you created ("WebMon"). Under this, create a 'Parameters' key.

9. Under the "Parameters" key, create an 'Application' string value. Set this to the location of the SVCMON executable (like "C:\SERVICE-MONITOR\SVCMON.EXE").

10. Also under the "Parameters" key, create an 'AppParameters' string value. Set this to the location of the configuration file for SVCMON (like "C:\SERVICE-MONITOR\SVCMON.CONF"). Figure 1 shows what the registry entries should look like:


Figure 1: Sample Registry Settings

11. Use SVCLIST.EXE to find the short name of the existing service you want to monitor.

12. Edit the configuration file for your environment. Variables you need to change are $service, $logfile, and the $reply, $to , and $smtp E-mail variables.

13. In the Services object of the Control Panel, find your new service. Set it to be started automatically. Now hit Start to start the monitoring service for the first time. From now on it will come up when the system boots.

14. If the service you are monitoring is not running when SVCMON starts, SVCMON will attempt to start it. From then on SVCMON will monitor it and take action when it senses that the monitored service is no longer active.

15. Be sure to check the log file to see whether SVCMON was able to start up properly or not. For most kinds of startup errors SVCMON will pop up a notification window, but you should check the log file to be sure.

• In step 9, the Application value should be the full path to wherever you have the perl interpreter installed, like "C:\PERL\BIN\PERL.EXE".
• In step 10, the AppParameters value should be the full path to the script, plus the full path to the configuration file, like "C:\SERVICE-MONITOR\SVCMON.PL C:\SERVICE-MONITOR\SVCMON.CONF ". 

You may also need to add the Perl bin directory to the PATH enviroment variable that your Command Prompt uses.

3. Configuration

All of the user-configurable settings are in the SVCMON.CONF file. This file is read by the script and executed. You should change the following variables for your site:

• $service – this is the name of the service that SVCMON will monitor. This must be the "short name" which is not the same as the name you see in the Services control panel. Use the included SVCLIST.EXE command to list the services running on your machine. Short names are in the leftmost column. This output may scroll off the screen, so either set your Command Prompt for scrollback or pipe the output to more, like
  "SVCLIST | MORE".
   
• $logfile – this is the full path name of the file into which SVCMON will write its log entries. Every time SVCMON starts it will clear the existing log.
   
• $from – this variable is the "From" address that will be used when SVCMON sends E-mail. From addresses can't have spaces (like "Foo Bar") unless an address is included (like "Foo Bar <baz>"), at least against MS Exchange 5.0 SMTP  Mail Service.
   
• $to – This is the address to which SVCMON will send mail. Note that @ signs must be escaped with a backslash ("\"). I use a full address () rather that just a user name, though a username by itself may work, depending on your mail server.
   
• $smtp – this is the IP address of your SMTP E-mail server. SVCMON does not support the use of DNS mail exchange (MX) records.

The remaining variables do not need to be changed for successful operation; they control the timing of various events within SVCMON. They are:

• $interval – how frequently SVCMON will check the status of the service (in seconds)
   
• $logfreq – SVCMON will periodically write a checkpoint message indicating that the service is active. This variable indicates how many status checks should elapse between checkpoint messages.
   
• $actionfreq – indicates how many checks should elapse between attempts to restart a failed service (and sending E-mail about it). This is backed off exponentially. First action is at time 0; then at $actionfreq *2, *4, *8, *16, etc.

4. Monitoring Multiple Services

It is possible to monitor more that one service at a time on any given server. SVCMON does not currently support this directly, but you can go through the installation process again using a second set of information. The following installation steps need different information in order to monitor a second service:

Step 2: choose a different directory
Step 5: different name for the monitoring service
Step 10: point to a different configuration file

5. NT Resource Kit Tools

The SRVANY.EXE and INSTSRV.EXE tools come from the Windows NT Resource Kit and are included in the distribution ZIP file for your convenience.

6. Limitations

- SVCMON does not distinguish between a service that hasn't started up yet during the boot process and one that has stopped. The result is that you may get one alert E-mail every time your server reboots.
- The SMTP mail notification is not particularly robust. If an error occurs there is no attempt at resending, There is no MX support, etc.
- Only one service is monitored by any single installation of SVCMON, though multiple installations on the same machine can each monitor a different service.
 

7. Possible Enhancements

- Support monitoring multiple services in a single installation and config file
- Use a more robust SMTP implementation (look at existing modules from CPAN)
- Support E-mailing via MAPI for organizations that don't use SMTP internally
- Find a way to avoid the "e-mail on boot" problem

dmm@city-net.com