Event Commands, Windows Services, & Director

I hope this is the best forum to post this in, I wasn’t sure.

I followed the doc here https://icinga.com/docs/icinga2/latest/doc/03-monitoring-basics/#use-event-commands-to-restart-service-daemon-via-command-endpoint-on-windows

I’m using director to create everything and I feel like I have it all matching up to what I see in the doc. I added the event command to a service and enabled event handling on the service, stopped the service in Windows, it went CRITICAL but it never restarted.

How can I troubleshoot this? Is there a log that would contain a failure to execute the script or anywhere that shows the event command even attempted to run? I looked at History and didn’t see anything related to an event command executing.

Does anyone have screenshots of how they have a windows service restart event command configured via Director?

For the script I used the one provided in the doc. I have regular service checks working with powershell scripts via director, just not the event command one.

Any help or guidance appreciated.

So, go here:

Change the log level to “debug”

Restart the Icinga2 service, process a passive result, then look here:

Check the logs there. With debug on you’ll see the commands its running. Most programming languages will spit out a stack trace if it fails.

Also, make sure you’ve put in code to keep it from restarting the service on it going OK HARD. Otherwise you potentially get a restart loop. There are examples in https://icinga.com/docs/icinga2/latest/doc/03-monitoring-basics/#use-event-commands-to-restart-service-daemon-via-command-endpoint-on-windows


Thanks Blake. It will be pretty awesome having icinga take action on things to save us time

I called our migration to Icinga2 “Operation: Ambien”. The pager now goes off every 2 hours all night instead of every 20 minutes. ¯\_(ツ)_/¯


I just realized I sent you the same link you’d already posted lol

If that were intentional it would have been super rude. Sorry.

No worries man haha.

Hoping to get this sorted out soon. Then maybe move beyond just restarting windows services and do some more cool stuff.

Hi, tried this too, looks like the howto from the manual is not working, if your restartscript is inside a folder with spaces.

Here is a working example with hardcoded path and proper escaping:

object EventCommand “restart_service-windows” {
command = [ “C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe” ]

arguments = {
“-command” = {
value = “& ‘C:\Program Files\ICINGA2\sbin\restart_service.ps1’”
order = -1

"-ServiceState" = "$service.state$"
"-ServiceStateType" = "$service.state_type$"
"-ServiceAttempt" = "$service.check_attempt$"
"-Service" = "$restart_service$"
"; exit" = {
    order = 99
    value = "$$LASTEXITCODE"


vars.restart_service = “$service.vars.IcingaCheckService_Array_Service$”

change the vars.restart_service to your service name variable, as I’am using the service check from the powershell framework.

1 Like