Jump to content

Monitor for list of computers without a service running?

Recommended Posts


I'm never sure where searches and monitors go in this forum, so I'm going to put this here. Let me know if I can put it somewhere better.

I'd like to create a Monitor that will list every computer that does not have a service called Umbrella_RC running. I've done a few things that have gotten me close, but nothing has come out exactly right. Here's what I have done:

  1. I can create a monitor that will show me all computers that have the service Umrella_RC running, but inversing the check or reversing the Query doesn't show me computers that do not have the service running. I don't think I'm using those features right.
  2. I can create a monitor that lists all services that are not Umbrella_RC, but that's a HUGE list and not helping at all.
  3. I can do a RAWSQL script will do exactly what I want it to do, except because it's RAWSQL it will not perform any monitor based actions, like send alerts or anything. It's basically just a list of machines without the service running, so that doesn't really help. Here is that RAWSQL string:
   computers.computerid as `Computer Id`,
   computers.name as `Computer Name`,
   clients.name as `Client Name`,
   computers.domain as `Computer Domain`,
   computers.username as `Computer User`
FROM Computers 
LEFT JOIN inv_operatingsystem ON (Computers.ComputerId=inv_operatingsystem.ComputerId)
LEFT JOIN Clients ON (Computers.ClientId=Clients.ClientId)
LEFT JOIN Locations ON (Computers.LocationId=Locations.LocationID)
((((SELECT COUNT(*) FROM Services WHERE services.ComputerId = Computers.ComputerId  AND Services.Name = 'Umbrella_RC')>0)))


That's the closest I've ever gotten in a monitor. For the above, the Query Results will be EXACTLY what I want, but they will not show up in the Status, so the status will always remain No Problems and it will never alert me. 

Can I take that SQL string and do better? Or is there a configuration Table\Field\Condition\Result combination that I could use that could create this list for me without using RAWSQL? So far, I haven't found it.


Edited by danblee

Share this post

Link to post
Share on other sites

Can you clarify: Do you want all systems WITH Umbrella_RC, where Umbrella_RC is not Running? Or do you want all systems that do not meet the criteria “Umbrella_RC status Is Running”? (Which would include both systems with Umbrella_RC stopped, and systems that do not have Umbrella_RC installed)

Share this post

Link to post
Share on other sites

You should not need a RAWSQL monitor. Try selecting the services table. Select the `name` column for the field to test, Equals for the condition, and Umbrella_RC for the result to test. Then in the Additional Conditions enter:


Finally, check the “Reverse Query” checkbox. The additional condition field might need to be services.state, I was just going from memory/guessing..

Share this post

Link to post
Share on other sites

@DarrenWhite99 This was exactly what I was looking for. This worked perfectly. I figured it would be something as easy as this, I just couldn't quite get the combination of conditions and reverse\invert queries together. 


Thanks again!

  • Thanks 1

Share this post

Link to post
Share on other sites

Hey there @DarrenWhite99,


Sorry for drudging up an old thread, but when I follow these steps via Internal Monitor, and I try "Build and view query" I get the attached error.

Can you help with what I'm doing wrong?


Screen Shot 2020-09-02 at 7.38.21 AM.png

Share this post

Link to post
Share on other sites

Services.Status isn't a thing. Services.State is what you would be looking for.  Here are two ways to build the monitor to find computers where Umbrella_RC is NOT running (either because it is stopped or because it is not installed).  The first version is the "Reverse Query" style, which can only be used for alert styles "Once Per XXX".  The second version allows you to use "Send Fail after Success" alerting and incorporate logic to ensure the computer is currently online.

Example as a Reverse Query:


Example using Additional Conditions:


  • Like 1

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...