Windows Services Health Check with uberAgent

Last published : Oct 14, 2026
This guide provides step-by-step instructions to set up Windows service monitoring with uberAgent\. It covers both the fast-to-deploy ESA approach and the customizable UXM scripting method\.
Related information
POC Guides

Option 1: Native ESA Monitoring - Fast to Deploy

uberAgent ESA monitors Windows services via Event Logs. It tracks service stop events and visualizes results in Splunk\.
Here's what you need to do:
  1. In uberAgent.conf, verify that ESA is enabled.
[ProductComponents]
EnableESA = true
  1. In uberAgent-ESA.conf, add the following configuration to enable Windows services monitoring: @configinclude uberAgent-ESA-eventlog.conf
  2. In uberAgent-ESA-eventlog-windows.conf, specify which services to monitor. The example below monitors the Windows Module Installer and Optimize drives services every minute. You can adjust the services and intervals as needed. Alternatively, you could also monitor on demand, but this uses more resources (details)\.
[Timer] 
Name = Eventlog 
EventLog=TimerBased-Service-Events 
Interval=60s

[EventLog Name=TimerBased-Service-Events] 
EventLog = System 
Provider=Service Control Manager 
EventFilterXPath=*[EventData[Data[@Name="param2"]="stopped"]  and (EventData[Data[@Name="param1"]="Windows Modules Installer"] or EventData[Data[@Name="param1"]="Optimize drives"])] 
EventID=7036
  1. Use uberAgent ESA's Windows Eventlogs dashboard to visualize the collected data. The dashboard can be found in the Splunk app uberAgent ESA OS Components -> Windows Eventlogs.
uberAgent-ESA-menu-bar
uberAgent-ESA-dashboard-table

Option 2: Custom script - tailored to your needs (PowerShell)

uberAgent UXM allows you to run custom scripts at set intervals for maximum flexibility.
  1. Save the following as C:\stopped_services.ps1 or whatever name and location you prefer.
# Get all stopped services
$stopped_services = (Get-Service | Where-Object {$_.Status -eq 'Stopped'}) -join ','
# Get select stopped services
# $stopped_services = Get-Service -Name service1,service2 | Where-Object {$_.Status -eq 'Stopped'}
[Hashtable]$Output = @{
    'stopped_services'="$stopped_services"
}
Write-Output $($Output.Keys.ForEach({"$_=$($Output.$_)"}) -join ' ')
Note: the above script collects all stopped services. If you want to monitor specific services, you can modify the script to filter for those services by name.
  1. In the uberAgent.conf, add a new timer to run the script every 5 minutes. Time timer will execute the PowerShell script in the context of the system session\.
[Timer]
Name = ServiceHealthCheck
Interval = 300000
Script = powershell.exe -executionpolicy bypass -file C:\stopped_services.ps1
ScriptContext = Session0AsSystem

Splunk Integration and Alerting

Connect Splunk alerts to ServiceNow to automatically create incidents when critical services fail. The following search query retrieves stopped services and formats them for easier analysis.
index=uberagent sourcetype="uberAgent:Script:ServiceHealthCheck"
| makemv delim="," stopped_servicesSplunk-custom-search
To set up alerts for stopped services, you can create a Splunk alert based on the search queries above\.
If your organization uses ServiceNow, please note that it is possible to configure Splunk alerts to automatically create incident tickets in ServiceNow and, these tickets can be routed to specific teams or individuals based on custom logic, such as the service affected, the host involved, or alert severity. This integration is managed entirely within Splunk using the ServiceNow Integration App or custom alert actions (webhooks or REST API calls), and no configuration changes are required on the uberAgent side.

Next Steps

  • Start with uberAgent ESA for quick wins.
  • Use uberAgent's custom script engine for custom service checks.
  • Explore the full uberAgent documentation for advanced configurations.