If I get an Alarm from this NRQL condition, it stays open even if the Service starts again.
FROM Metric SELECT count(*) WHERE windowsService.startMode='auto' AND windowsService.state IS NOT NULL AND windowsService.state !='running' FACET windowsService.entityName, windowsService.hostname , windowsService.name, windowsService.state, windowsService.startMode
For me it looks like the Service has a new ID and does not correspond to the Service that was stopped.
If I get an Alarm from this NRQL condition, it stays open even if the Service starts again.
FROM Metric SELECT count(*) WHERE windowsService.startMode='auto' AND windowsService.state IS NOT NULL AND windowsService.state !='running' FACET windowsService.entityName, windowsService.hostname , windowsService.name, windowsService.state, windowsService.startMode
For me it looks like the Service has a new ID and does not correspond to the Service that was stopped.