Hello
Can some please clear up the following point for me, thanks
HealthService.exe is the Agent (System Center Management, I believe renamed in 2012 R2).
Now an instance of MonitoringHost is kicked of say when you have a monitor which contains a script (e.g. VBScript, JScript or PowerShell Script in the case of a Windows System) correct for far?
Question 1:
Now what about a simple monitor like check Windows Application Event Log for Event 123, I understand this is using a built in predefined module to access this data source (ultimately via the windows api for the event log). If that is correct is there a need to fire off and instance of MonitoringHost.exe of can the agent e.g. HealthService.exe take care of this internally.
Question 2:
I understand the purpose of firing off instanced of MonitoringHost.exe is to separate out executing instances from the HeatlhService.exe itself the logic being if a bad script in a Monitor or Rule for example hangs of crashes its particular instance of MontoringHost.exe it does not effect the Agent itself running as HealthService.exe is that correct?
Question 3:
I also understand that if several such script based monitors/Rules are running under the same credentials e.g. 'agent action account' they will all be run under the same MonitoringHost.exe where possible. If a rule or monitor is using a RunAs profile/Account it will fire of its own instance of MonitoringHost.exe as the credentials are different (which would make sense) is this correct too?
Question 4:
I understand (but not at all sure), that the 'agent action account' is not the same (e.g. not necessarily running using the same credentials) as the agent itself (HealthService.exe). Therefore where as the agent would be running under 'Local System' (which I understand if the recommendation, not sure if it would run under another ID any way?) I think the 'agent action account' is used as the default account to fire off instances of MonitoringHost.exe (as above) unless as alternative RunAs Profile/Account is specified for a particular workflow, is this correct?
Thank you all in advance for helping me in trying to understand what is actually going on under the hood :)
AAnotherUser__
AAnotherUser__