BSOD Monitoring

Purpose

The BSOD Monitoring solution monitors Windows endpoints for Blue Screen of Death (BSOD) related events by periodically scanning the Windows System event log. It generates an alert only when the number of BSOD-related events exceeds a configurable threshold within a specified monitoring period.

The solution consists of two components:

• A Configuration Writer task that creates a local JSON configuration file containing the monitoring settings.
• A Monitor that periodically reads the configuration file, checks the Windows System event log, and generates alerts when the configured threshold is exceeded.

This approach allows monitoring policies to be managed centrally through CW RMM variables without modifying the monitoring script.

Key Capabilities

1. Configurable Threshold
   Configure the maximum number of BSOD-related events that are allowed before an alert is generated.

2. Configurable Monitoring Period
   Define the number of previous days that the monitor searches the Windows System event log for BSOD-related events.

3. Centralized Configuration
   Monitoring settings are stored in a local JSON configuration file generated by the BSOD Monitoring Configuration Writer task. This allows threshold changes to be managed through CW RMM variables without modifying the monitor script.

4. Automatic Recovery
   When the number of detected BSOD-related events falls back within the configured threshold, the monitor reports a healthy state. If automatic resolution is enabled in the monitor set, the associated alert or ticket is resolved automatically.

Important Caveats & Behavior

1. Configuration Updates Changes to the CW RMM variables are not applied until the BSOD Monitoring Configuration Writer task runs again. Running the task manually updates the configuration immediately.

2. Monitor Execution The monitor reads the local configuration file each time it runs and evaluates the Windows System event log using the configured settings.

3. Monitored Events The monitor searches the Windows System event log for the following BSOD-related events:

   • Event ID 41 – Kernel-Power (unexpected shutdown or restart).
   • Event ID 1001 – BugCheck (Blue Screen of Death).
   • Event ID 6008 – Unexpected shutdown.

4. Automatic Resolution Once the number of detected BSOD-related events falls back within the configured threshold, the monitor returns a healthy state. If automatic resolution is enabled, the associated alert or ticket is resolved automatically.

Associated Content

Group

Name	Purpose
BSOD Monitoring	Dynamic group containing endpoints where BSOD monitoring is enabled.

Task

Name	Purpose
BSOD Monitoring Configuration Writer	Creates the local JSON configuration file containing the BSOD monitoring threshold and monitoring period.

Monitor

Name	Purpose
BSOD Monitoring	Reads the configuration file, scans the Windows System event log for BSOD-related events, and generates alerts when the configured threshold is exceeded.

Custom Fields

Name	Level	Type	Purpose
BSOD_Evaluation_Days	Company	Text	Number of previous days to check for BSOD-related events in the Windows System event log. Default is 7 days.
BSOD_Threshold	Company	Text	Maximum allowed BSOD-related events before triggering an alert. Default Value is '3'.
BSOD_Monitoring_Enable	Company	Drop-Down	Enables/disables BSOD monitoring at the Company level.
BSOD_Monitoring_Enable_Site	Site	Drop-Down	Enables/disables BSOD monitoring at the Site level.
BSOD_Monitoring_Enable_Endpoint	Endpoint	Drop-Down	Enables/disables CPU monitoring for servers at the Endpoint level.

Implementation

Step 1: Create the Following Custom Fields

Create all the custom fields listed below in ConnectWise RMM. These are required for the solution to function correctly.

• BSOD_Evaluation_Days
• BSOD_Threshold
• BSOD_Monitoring_Enable
• BSOD_Monitoring_Enable_Site
• BSOD_Monitoring_Enable_Endpoint

Step 2: Create the Group

Create the dynamic group that will automatically target the enabled machines.

• BSOD Monitoring

Step 3: Create the Configuration Writer Task

Set up the configuration writer script that will run on the targeted endpoints.

• BSOD Monitoring Configuration Writer

Step 4: Create the Monitor

Set up the monitor that will evaluate CPU usage against the configuration file.

• BSOD Monitoring

Step 5: Schedule the Configuration Writer

Schedule the Task : BSOD Monitoring Configuration Writer to run once per day against the Group : BSOD Monitoring, as described in the Schedule Task section of the task's document.

The monitor can run independently at your preferred monitoring interval.

Step 6: Review and Set Threshold Custom Fields

Review the default values and set the Custom Field: BSOD_Evaluation_Days and Custom Field: BSOD_Threshold as required for your environments. Or could also use the default values.

Step 7: Review and Set Enablement Custom Fields

Set the enablement custom fields (BSOD_Monitoring_Enable, BSOD_Monitoring_Enable_Site, BSOD_Monitoring_Enable_Endpoint) to Enable for the client, location, or specific endpoint to turn the solution and monitoring on for them. Machines will not be monitored until they are explicitly enabled via these dropdown fields.

FAQ

Q: How does the BSOD Monitoring solution work?

The Task : BSOD Monitoring Configuration Writer creates a local JSON configuration file containing the monitoring threshold and evaluation period. The Monitor : BSOD Monitoring monitor reads this file, scans the Windows System event log for Event IDs 41, 1001, and 6008, counts the matching events within the configured number of days, and compares the total against the configured threshold.

Q: What are the default monitoring values?

If no valid CW RMM variables are configured, the solution uses the following defaults:

• Threshold: 3 events
• Evaluation Period: 7 days

Q: I changed the CW RMM variables. When will the new values take effect?

The updated values are applied the next time the Task : BSOD Monitoring Configuration Writer runs. You can also execute the task manually to update the configuration immediately.

Q: Which Windows events are monitored?

The monitor searches the Windows System event log for the following BSOD-related events:

• Event ID 41 – Kernel-Power (unexpected shutdown or restart)
• Event ID 1001 – BugCheck (Blue Screen of Death)
• Event ID 6008 – Unexpected Shutdown

Q: When is an alert generated?

An alert is generated when the number of detected BSOD-related events within the configured evaluation period exceeds the configured Threshold.

Q: Will alerts resolve automatically?

Yes. When the number of detected BSOD-related events falls back within the configured threshold, the monitor reports a healthy state. If automatic resolution is enabled in the monitor set, the associated alert or ticket is resolved automatically.

Q: The monitor reports "Configuration file not found." What should I do?

This indicates that the BSOD Monitoring Configuration Writer task has not yet run on the endpoint or the configuration file has been removed. Run the task manually or wait for its next scheduled execution.

Q: Can I modify the JSON configuration file manually?

Manual changes are temporary and will be overwritten the next time the Task : BSOD Monitoring Configuration Writer runs. Always update the CW RMM variables instead of editing the configuration file directly.

Q: What information does the monitor output contain?

The monitor reports the total number of BSOD-related events detected, the monitored Event IDs (41, 1001, and 6008), and the configured evaluation period.

Changelog

2026-07-21

• Initial version of the document