Recently I worked on a case where customer is having a requirement to create a Monitor where he can override the frequency and sample count value.

All the built in service monitoring uses Monitors that reference the Microsoft.Windows.CheckNTServiceStateMonitorType monitortype, which is in the Microsoft.Windows.Library mp.

This MonitorType has a hard-coded definition with <Frequency>30</Frequency> and <MatchCount>2</MatchCount>.  This means by default, monitors that use this will inspect the service state every 30 seconds, and alarm when it is not running after two consecutive checks.  However, the challenge is that we did not expose these values as override-able parameters.

Here is the management pack which I have created to expose those values as an overridable parameter, and it works like a charm.

If you have any such kind of requirements from the customers, you can share the attached MP with the customer. But please take a note that you may need to change all the references in the MP according to the version of dependent MP in customer environment. Also, you need to change the service name for which you need to create the monitor.

The MP is having the followings and you may need to tweak it. To get the management pack, please hit in the below URL to download it.

1. It has its own discovery which will automatically discover the objects based on the service name you have provided in the following section.

        <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.WmiProviderWithClassSnapshotDataMapper">


         <Query>SELECT * FROM Win32_Service WHERE Name='VMTools'</Query>

          <!-- Example query here:  <Query><![CDATA[select * from Win32_Service where Name = 'spooler' and startmode = 'Manual']]></Query> -->


          <!-- seconds -->

2. It has the overridable parameter in the monitor where you can change the value as per your need.

3. You may need to change the versions of the following references based on the SCOM version you have (I have built it for SCOM 2012 R2)

4. You may need to change the name of the discovery, class, target names. The best easiest way would be to replace the existing service name with the actual service name.