SCOM 2007 R2 – create a dynamic group using a specific service as a filter

I got a request to configure monitoring and auto-recovery for CommVault backup client services on all servers running the backup client. SCOM offers an option to create a dynamic group and filter its membership using the service name.

Store the new attribute and the new group in the same custom MP, in order for the attribute to appear in the dropdown list. First, create a new attribute. The attribute uses a WMI query to check if the specific CommVault service is running on a server.

In the Discovery Method window/tab, select:

Discovery Type: WMI Query
Target: Windows Computer_Extended
Management Pack: use your own custom MP

In the WMI Configuration window/tab select:

WMI Namespace: root\cimv2
Query: SELECT * FROM Win32_Service where Name = "typeServiceNameHere"
e.g. SELECT * FROM Win32_Service where Name = "GxEvMgrC(Instance001)"
Property Name: Name
Frequency: the default value is 900 secs, but this can be set to 3600 or even higher

Save and close the new attribute.

Then create a new group. In the Dynamic Members window/tab, click on Create/Edit rules.

In the Class drop-down menu, select Windows Computer and click Add.
In the lower part of the window, click the drop-down menu arrow in the first field and select the name of the newly created attribute.
In the second field, select Equals.
In the third field, type the service name.

Give it some time to populate and then right click the group and click on View Group Members to check if the group was populated.

Then create 2 service monitors for “Commvault Client Event Manager“ and “Commvault Communications Service” and used the dynamic group to define the targeted group.

If you are filtering alerts per both priority and severity, you will need to change priority level to High:

Right click the newly created monitoring service object under Authoring > Management Pack Templates > Windows Services, click View Management Pack Objects, and click on Monitors.

Expand the new monitor > Entity Health > Availability, and open properties of the Service Running State monitor stored in your custom MP.

Open the tab Alerting and change the priority level.

You may setup a recovery task under the Diagnostic and Recovery tab which will restart the service in case it crashes.

You can find more info here:
Building dynamic groups using WMI Queries
WMI Samples - Monitoring Operating Systems