I know that SCOM can restart the service automatically, it can even run scripts to check if it was OK.
but in some cases, especially when the service need a complex check before the service is marked OK, you might want to use Orchestrator
Luckily the Monitor Alert is easy to use and it has all data from the alert, that we can utilize to restart the correct service.
I have created a runbook for this specific task.
The runbook is setup the following way:
1. Monitor Alert: This activity is setup to monitor one or more Monitoring Rules/monitors, and by using the Rule ID instead of the name, we have complete control of which alerts triggers the runbook. (use powershell to find the ruleID for the alert you need). You can use any of the fields, but I generally recommend to use IDs instead of Text strings.
2. Start Maintenance Mode: Use the MonitoringObjectFullName from the Monitor Alert activity. Set the Reason to UnplannedOther or any other reason you would like. Set the comment to insert the runbook name (or even runbook ID too)
Now comes the exiting part
3. Query XML: By using the Query XML activity, we can read the context XML from the alert. This context always includes a lot of information about the alert. In this case we can get the DisplayName of the Service by using an XPath query (look here for more help on the subject: http://technet.microsoft.com/en-us/library/hh206079.aspx ).
4. Start/Stop Service: Use the NetbiosComputerName from the alert activity to find the computername. also add error handling if service cannot start, I use Update Alert to update the alert adding a comment in a customfield describing the error.
5. Optional: Link between Start/Stop Server and Get Service Status. This link is setup to delay 120 seconds, this way we can check if the service did really start and run
6. Get Service Status: Use the published data from start/stop service to get the computer and service name. also add error handling if the service is not running
7. Optional: Add Looping if service is not running yet, since some service can be slow at starting. but remember to limit the number of loops so that you will not get an infinite.
8. Stop Maintenance Mode: use the FullName from Start maintenance mode to get the monitor value
9. Update Alert: Update CustomField inserting “Service started by Orchestrator”
Runbook is complete!
You can download the runbook in the begging of this article