Files
windows_exporter/docs/runbooks/windowsservicenotrunning.md
T

46 lines
1.9 KiB
Markdown

---
title: WindowsServiceNotRunning
---
## Meaning
The service `service` has the start mode `auto` but has not been in the
`running` state for 15 minutes. Trigger-start services, which Windows stops by
design when their trigger condition ends, are left out through the
`trigger_start` label of `windows_service_info`. Delayed-start services are
included; the 15 minute duration covers their later start after a reboot.
## Impact
A service that should always run is stopped, so the function it provides is
unavailable, for example printing, time synchronization, a site or a
database instance. Windows restarts a crashed service only when its recovery
options say so.
## Diagnosis
1. Inspect the current state of the service and when it changed:
```promql
windows_service_state{job="windows_exporter", service="<service>"} == 1
```
2. Check the System event log for Service Control Manager events 7000, 7009,
7031 and 7034, and the Application log for crashes of the service process.
3. Check `windows_service_info` for the account in `run_as`; an expired
password or a removed right to log on as a service stops the service at the
next start. `windows_service_process` shows whether a process is running.
4. Check whether the service was stopped on purpose for maintenance or
disabled by policy, and whether it depends on another service that is also
stopped.
## Mitigation
Start the service after fixing the cause: the account, a missing dependency, a
configuration error or a crash. Set recovery options so Windows restarts the
service itself. Change the start mode to `manual` or `disabled` for services
that should not run, or exclude them with the `serviceSelector` when the mixin
should not watch them. For example
`serviceSelector: 'service!~"sppsvc|gupdate|edgeupdate"'` ignores services that
exit on their own by design. Confirm the service stays running.