无互联网离线环境下Windows 2019 Servers的Windows Services与Event Logs短期监控方案咨询

Hey there! Let’s tackle this offline monitoring challenge for your Windows 2019 servers—since you’re stuck without internet and waiting for formal SIEM tools, here are some free, Microsoft-focused (and a couple open-source) options that work perfectly in a disconnected environment:

微软原生免费方案（完全离线可用，无需额外下载） #

1. Windows Event Collector (WEC) + 集中式Event Viewer #

This is your best bet for native, zero-cost event log monitoring—all components are pre-installed on Windows 2019, so no internet needed to set up.

• How it works: Pick one server to act as your central event collector. Enable the Windows Event Collector service on it, then create event subscriptions that pull critical logs (like system, security, or service-specific events) from your other servers. For service monitoring, filter for key event IDs: 7000 (service failed to start), 7001 (service dependency failure), and 7036 (service status changed).
• Offline setup tips: Make sure all servers are in the same domain or a trusted workgroup. Use local admin or domain accounts for authorization—no internet checks required here.
• Perk: You’ll get a single place to view all event logs across your fleet, so you don’t have to log into each server individually to troubleshoot.

2. PowerShell Scripts + Task Scheduler (Service Status Tracking) #

A simple, flexible way to keep tabs on service health without fancy tools:

• Write a lightweight PowerShell script to check for services that aren’t running, then save the results to a shared network folder (accessible to all servers):

# Check for non-running services and export to shared log location
$outputFile = "\\YourCentralServer\MonitoringShared\ServiceCheck_$env:COMPUTERNAME_$(Get-Date -Format 'yyyyMMddHHmm').txt"
Get-Service | Where-Object {$_.Status -ne 'Running'} | Select-Object Name, DisplayName, Status, StartType | Out-File $outputFile -Encoding UTF8

• Use Task Scheduler on each server to run this script on a schedule (e.g., every hour). You can then check the shared folder anytime to see which servers have service issues.
• Pro move: Add logic to the script to automatically restart critical services if they stop, and log the restart attempt for your records.

3. Task Scheduler Alerts for Critical Events #

For high-priority services, set up immediate alerts right from Windows Task Scheduler:

• Create a task triggered by specific event log entries (e.g., event ID 7036 when a service stops).
• Configure the task to take action: write a detailed log to the shared folder, send an email if you have an internal mail server, or even run a script to restart the service automatically.

Open-Source Alternative (Prep for Offline Deployment) #

If you’re open to non-Microsoft tools, Nagios Core is a solid option—just make sure to prep everything offline first:

• Download the Nagios Core installer and Windows client plugin (NSClient++) on a machine with internet, then copy them to your offline environment.
• Set up a Nagios central server, and install the client plugin on each Windows 2019 server. Configure it to monitor service status and event logs, with data sent back to the Nagios server over your internal network.
• Perk: Nagios gives you a visual dashboard to track all your servers’ health, with customizable alert rules.

备注：内容来源于stack exchange，提问作者winsysadmin