Troubleshooting Advanced Triggers in ControlUp

A user had an issue with an advanced trigger not firing correctly and asked for advice. Other triggers were working, but this one was not. Other users suggested troubleshooting steps such as checking logs and querying the server. The issue was resolved with guidance from the ControlUp team.

Read the entire ‘Troubleshooting Advanced Triggers in ControlUp’ thread below:

Sanity Check…

My Friday-brain kicks in.

I created an adv trigger for Citrix Desktop Service which should write an event in application log when the desktop service is stopped.

So I created the advanced trigger with the condition (see pictures) and stopped the Desktop Service on a machine manually but no trigger fires…

This is an easy one but brain-freeze…

check incidents tab first if it fires at all I agree that it should work. (I am assuming it has an updated agent here)

@member have you added the Citrix Desktop service to the list of Service Monitoring?

https://support.controlup.com/docs/using-windows-services-to-activate-triggers

step 1 from the above KB?

Yes, I added the "Display Name" which seems to be "Citrix Desktop Service"

hmm.. ok

So I guess we need some troubleshooting here, agent & Monitor log4net logs etc… I suggest a support ticket

(unless you feel like reviewing some log files yourself?)

I would also verify the Monitor is properly connected to the agent / machine where you stop the service, and possibly verifying that another, simple trigger (like process start) is properly identified on this machine

(if another simple agent trigger works on this machine, we can focus specifically on Service Monitoring)

@member: In incidents tab I see the other "test-triggers" I setup but not the advanced trigger with the service checkup.

I upgraded Console + Agents (and Monitor) from 8.8.0.1060 to 8.8.0.1097. Issue persists…

@member: Other triggers are working on that specific machine. Will check with log4net later…

Sounds that you did everything correctly. But here’s what we can check.

1. Once you add the config on the console side to monitor XYZ service, it should show up on the agent side in C:\Windows\System32\config\systemprofile\AppData\Roaming\ControlUp\AgentConfiguration.Json
2. Place the log4net I added here. It’s on FATAL for everything excluding the services log so it will be slim.
3. Once the service is going into Stopped state, you should see something e.g. in my test –

‘2024-03-08 23:28:19,921′,SmartX.ControlUp.Agent.Services,'[22]’,’DEBUG’,’Monitored service "Print Spooler" crossed the threshold of 00:00:30 seconds. Sending to monitor.’

1. a long shot but nevertheless, look in the registry (agent side) at HKEY_LOCAL_MACHINE\SOFTWARE\Smart-X\ControlUp\Agent or ..\Agent\Services and see if you can spot keys related to services. If any. Shouldn’t be by default.
2. Also query the monitor with Invoke-CUQuery if you see in the agent log that the service was sent to the monitor (like in my screenshot). You can do –

“`$pathtomodule = (Get-ChildItem "C:\Program Files\Smart-X\ControlUpMonitor*ControlUp.PowerShell.User.dll" -Recurse | Sort-Object LastWriteTime -Descending)[0]

Import-Module $pathtomodule

(Invoke-CUQuery -Table Services -Fields ServiceDisplayName,Machine,State).Data“`

Let me know the results. :the_horns::skin-tone-3:

excellent stuff @member!

@member the steps from Yair should help find the root cause in your org / setup

Continue reading and comment on the thread ‘Troubleshooting Advanced Triggers in ControlUp’.  Not a member? Join Here!