Introduction
Alert when a service stops — or starts — and optionally restart it automatically. The Service monitor watches a named service and fires when it hits the condition you've configured, making it the right tool for keeping critical services running without manual intervention.
Service Monitor
Level checks the state of the named service on covered devices. When the condition (stopped or running) is sustained for your breach duration, Level creates an alert — and if you've enabled the auto-restart option, attempts to start the service immediately.
Configuring Service Monitor
Open the target monitor policy, then add or edit a Service monitor. The Edit monitor panel opens on the right.
Name and Type
Enter a name in the Name field. Something like "SSH Service Stopped" or "Print Spooler - Stopped" tells you immediately what the alert means.
Set Type to Service.
Severity
Set Severity based on the impact of the service condition:
Information
Warning
Critical
Emergency
Operating System
Select the OS the target service runs on: Windows, macOS, or Linux. Service names and management differ by platform, so scoping the monitor to the correct OS ensures accurate matching.
Service Name
Enter the service name in the Service name field. Use the service's internal name, not its display name.
⚠️ WARNING: Use the service's internal name, not its display name. On Windows, these are often different — for example, the display name "Print Spooler" has the internal service name Spooler. Using the display name will cause the monitor to not match.
💡 TIP: To find the correct service name:
Windows: Open Services (
services.msc), right-click a service → Properties → check the Service name field at the top (not "Display name")macOS: Run
launchctl listin TerminalLinux: Run
systemctl list-units --type=serviceor check the.serviceunit file name
Trigger
Trigger sets the condition that fires the alert:
Is stopped — alert when the service is not running
Is running — alert when the service is detected as running
Breach Duration
Breach duration sets how long the service must be in the trigger state before an alert fires. Adjust using the slider or up/down arrows. Range is 0–120 minutes.
Setting 0 fires the alert immediately when the condition is detected. A small buffer (1–2 minutes) handles cases where services briefly stop during updates or restarts without generating false alerts.
Auto-Resolve
Auto-resolve alert if it is no longer applicable closes the alert when the service returns to the opposite state — for example, when a stopped service starts running again. Enabled by default.
Automatic Service Action
The Service monitor includes a toggle that takes automatic action on the service when the alert fires. The label and behavior change depending on your Trigger setting:
Trigger: Is stopped → toggle reads Automatically start the service if stopped — Level attempts to start the service when it's detected as stopped
Trigger: Is running → toggle reads Automatically stop the service if running — Level attempts to stop the service when it's detected as running
💡 TIP: The auto-start option gives you self-healing behavior for critical services. Enable it for services that should never be stopped — antivirus, backup agents, essential daemons — and keep the alert active so you still have a record of the incident even when it self-resolves.
Remediation
Attach one or more automations to run when this monitor fires — notify your team, log the incident, or run additional diagnostics.
Click in the Remediation field and select an automation.
To add more, click + Add another remediation.
To remove one, click the × next to it.
ℹ️ NOTE: Remediations run when the alert is created, not when it resolves. If you've also enabled Automatically start the service if stopped, the auto-start and the remediation automation both run on trigger.
Notifications
Send notifications on alert creation — policy recipients get an email when the alert fires
Send notifications on alert resolution — policy recipients get an email when the alert resolves
Recipients are managed at the monitor policy level, in the Recipients section.
Saving the Monitor
Click Update monitor to save changes, or Add monitor when adding a new one.
FAQ
Who can create and edit monitors? Technicians with access to the relevant monitor policy. Permission settings are managed in Workspace → Permissions.
My service monitor isn't matching even though the service exists. What's wrong? The most common cause is using the display name instead of the service name. On Windows, open
services.msc, find your service, right-click → Properties, and use the value in the Service name field — not the name shown in the list.Does "Automatically start the service if stopped" work across all platforms? Confirm platform support before publishing — the toggle is present in the UI but cross-platform behavior (especially for macOS launchd vs. Linux systemd vs. Windows SCM) should be verified.
What's the difference between the Service monitor and the Process monitor? The Service monitor targets registered system services managed by the OS service manager (Windows SCM, macOS launchd, Linux systemd). It also has the auto-restart option. The Process monitor watches for any running process by name, regardless of whether it's a registered service.
What happens to open service alerts if I delete the monitor? Existing alerts remain in place. Deleting a monitor doesn't close alerts it already created — resolve those manually.