Event ID 7031: Service crash

Event ID 7031: Service crash

Symptoms

Event ID 7031 gets logged when a service crashes. The Service Control Manager logs this event when a service stops unexpectedly. The message says which service failed, how many times it failed and the corrective action that will be taken.

Remediation

You can change the automatic recovery actions that need to be taken when the service fails to ensure your critical services are always up and running. The recovery option can be set in Control Panel > Administrative Tools > Services

Real-time alerts

1. Create a targeted alert in EventLog Analyzer for Event ID 7031. Go to the Log360 console > SIEM > Alerts > Add Alert Profile > select Alert > select Event ID from the drop-down > select Equals and add 7031.
2. Add other details like the alert name, severity, and devices. Include the device name, user account, and domain in the alert message, and enable notifications.
3. Receive notifications with essential details like device name and user account, and enable the security admin to swiftly identify the system in which the event occurred.