Monitoring a service that runs as svchost


I would like to monitor the status of Network Policy Server in Windows 2008. This service was previously known as IAS in server 03. The issue is the service runs as svchost and I can’t figure out how to monitor it. The path to executable states the following “C:\Windows\System32\svchost.exe -k netsvcs” I have tried many commands for instance:

check_nt!PROCSTATE!-d SHOWALL svchost.exe -k netsvcs

check_nt!PROCSTATE!-d SHOWALL netsvcs.exe

Help please.


It still runs as IAS in server 2008. You should define your check as a service instead of a proccess and generate an alert if that service is not running.