Overview

This check monitors the state of any Windows Service and submits a service check to Datadog.

Setup

Installation

The Windows Service check is installed by default with the Datadog Agent, but is not configured. Please see the next section to configure the check.

Configuration

The configuration is located in the windows_service.d/conf.yaml file in the conf.d/ folder at the root of your Agent’s configuration directory. See the sample windows_service.d/conf.yaml for all available configuration options. When you are done editing the configuration file, restart the Agent to load the new configuration.

The check can monitor all services on the system or selectively monitor a few services by name. Beginning with Agent version 7.41, the check can select which services to monitor based on their startup type.

This example configuration monitors only the Dnscache and wmiApSrv services:

instances:
  - services:
    - dnscache
    - wmiapsrv

This example uses the ALL keyword to monitor all services on the host. If the ALL keyword is used, the other patterns in the instance are ignored.

instances:
  - services:
    - ALL

The check uses case-insensitive Python regular expressions when matching service names. If a service name includes special characters, you must escape the special characters with a \. For example, MSSQL$CRMAWS becomes MSSQL\$CRMAWS and Web Server (prod) becomes Web Server \(prod\). The service name pattern matches all service names that start with the pattern. For an exact match, use the regular expression ^service$.

Provide service names as they appear in the service name field, NOT the display name field. For example, configure the service name datadogagent NOT the display name Datadog Agent.

Beginning with Agent version 7.41, the check can select which services to monitor based on their startup type. For example, to monitor only the services that have an automatic or automatic_delayed_start startup type.

instances:
  - services:
    - startup_type: automatic
    - startup_type: automatic_delayed_start

The possible values for startup_type are:

• disabled
• manual
• automatic
• automatic_delayed_start

Beginning with Agent version 7.50, the check can select which services to monitor based on whether they have a Service Trigger assigned. Below are some examples showing possible configurations.

# Matches all services that do not have a trigger
services:
  - trigger_start: false

# Matches all services with an automatic startup type and excludes services with triggers
services:
  - startup_type: automatic
    trigger_start: false

# Only matches EventLog service when its startup type is automatic and has triggers
services:
  - name: EventLog
    startup_type: automatic
    trigger_start: true

Tags

The check automatically tags the Windows service name to each service check in the windows_service:<SERVICE> tag. The <SERVICE> name in the tag uses lowercase and special characters are replaced with underscores. See Getting Started with Tags for more information.

NOTE: The check also automatically tags the Windows service name to each service check in the service:<SERVICE> tag. This behavior is deprecated. In a future version of the Agent, the check will stop automatically assigning this tag. To stop the check from automatically assigning this tag and to disable the associated deprecation warning, set the disable_legacy_service_tag option. See Assigning Tags for information on how to assign the service tag to a service.

Beginning with Agent version 7.40, the check can add a windows_service_startup_type:<STARTUP_TYPE> tag to each service check to indicate the startup type of the service. Set the windows_service_startup_type_tag option to include this tag with each service check.

Beginning with Agent version 7.55, the check can add a display_name:<DISPLAY_NAME> tag to each service check to indicate the display name of the service. Set the collect_display_name_as_tag option to true to include this tag with each service check.

Validation

Run the Agent’s status subcommand and look for windows_service under the Checks section.

Data Collected

Metrics

The Windows Service check does not include any metrics.

Events

The Windows Service check does not include any events.

Service Checks

windows_service.state
Returns OK if the windows service is in Running state, CRITICAL if it is Stopped, UNKNOWN if it is Unknown, and WARNING for the other service states.
Statuses: ok, warning, critical, unknown

Troubleshooting

Need help? Contact Datadog support.

Service permissions

If a service is present and matches the configuration, but the Datadog Agent does not report a service check for the service, the Datadog Agent might have insufficient permissions. For example, by default the Datadog Agent does not have access to the NTDS Active Directory Domain Services service. To verify this, run the check from an elevated (run as Admin) PowerShell shell.

& "$env:ProgramFiles\Datadog\Datadog Agent\bin\agent.exe" check windows_service

If the service is present in the output, permissions are the issue. To give the Datadog Agent permission grant Read access on the service to the Datadog Agent User. We recommend granting Read access with Group Policy to ensure the permissions persist through Windows Updates.

Further Reading

• Monitoring Windows Server 2012
• How to collect Windows Server 2012 metrics
• Monitoring Windows Server 2012 with Datadog