Zenoss is a great tool for monitoring all aspects of your IT, amongst those are Windows services. This means Zenoss can tell you when service XYZ has stopped running on your Windows box. The logical next step is to automatically try and restart these services. Zenoss actually comes with a tool that will allow you to do exactly that. winexe allows one to execute any command remotely on a windows machine, which means Zenoss can restart Windows services. Here is how you do it:

1. Create an Event Mapping

Event Class Transforms run against any event of a particular Event Class. Our Event Class Transform will therefore modify any /Status/WinService event. The Tranform will extract the Windows service name from the event so we can use it in our Event Command. This will enable us to restart any service instead of just specific ones.

Go to /Events/Status/WinService and there go to Page Menu > More > Transform (see below)

Now enter the following code into the Transform text field (pay attention to proper indentation):

#get service name
msg = getattr(evt, "message", None)
#parse the message which looks like this
#Windows Service 'W32Time' is down
if msg:
service = msg.split("'")[1]
#make new message now with only service name
#we don't loose anything since summary is the same message
evt.message = service

After pressing “Save” you are done

2. Setup the Event Command

Next we want to setup the command that restarts the service.

Go to Event Manager Commands and create a new Event Command (see below).

In the screen above you can make various adjustments that have an impact on how the command is executed. The timeout impacts how long Zenoss will give the command to execute. The delay is the time between when the filter is triggered and when the command is executed. Lastly you have the option to specify a repeate time which will allow you to execute the specified command every x seconds (or turn repeats of by setting this time to 0).

Finally we enter the following as the Command:

winexe -U "${dev/zWinUser}%${dev/zWinPassword}" //${dev/manageIp} "net start ${evt/message}"

The last part of this message should look familiar to many Windows administrators — it is the net command. Once Zenoss triggers this command the ${} TALES expressions will be populated, the last part (${evt/message}) will be populated with the service name since we extracted that in the Event Class Transform above. If you want to confirm/see the command being executed you can simply tail $ZENHOME/log/zenactions.log, there might be some delay between the event coming in and the command executing.