mickem/nscp 0.11.28

on GitHub

What's Changed

check_service overhaul

Fixed a reported bug as well as overhauled the check with some new features and modernized the checks.

This is technically a breaking change, in that it will classify some services as "ok" which was not before.
But I doubt that anyone relied on the default checking of all services

• state_is_perfect() now treats auto-start services with triggers as OK when stopped (trigger-start services legitimately remain stopped until their trigger fires)
• state_is_ok() now treats auto-start services with triggers as OK when stopped (same as delayed services were already treated)
• state_is_ok() now treats auto-start services that stopped with exit code 0 as OK (services like WslInstaller that start, complete their task, and stop cleanly no longer trigger CRITICAL)
• Added new filter keyword 'exit_code' exposing the Win32 exit code of a service. Allows users to write custom filters like 'exit_code != 0' to detect failed services
• Improved error logging in trigger detection. fetch_triggers() previously swallowed all errors silently; now logs unexpected failures
• check_service: Updated service classification list for Windows 11 24H2 / Server 2025
  • Added modern services: WslInstaller, WaaSMedicSvc, UsoSvc, DoSvc, CoreMessagingRegistrar,
    SecurityHealthService, SystemEventsBroker, vmcompute, HNS, sshd, LxssManager, and others
  • Removed obsolete services no longer present in modern Windows: Browser, NtFrs, IISADMIN,
    TlntSvr, napagent, IEEtwCollectorService, UI0Detect, SMTPSVC, aspnet_state, and others
  • Reclassified: COMSysApp (essential → ignored), SystemEventsBroker (supporting → system),
    WerSvc/wercplsupport (role → ignored)
  • Fixed casing: Eventsystem → EventSystem, systemEventsBroker → SystemEventsBroker
• Changed default detail-syntax to include exit_code. From ${name}=${state} (${start_type})into ${name}=${state}, exit=%(exit_code), type=%(start_type)
• Removed warning messages for excluded services. If a service is excluded we will not try to enumerate it.

Also improves debugging filters a bit:

• Improved how expressions are rendered when using debug
• Fixed issue with type resolution for "unary functions" i.e. not( something ). Before it would fail to parse the expression with an error.

Full Changelog: 0.11.27...0.11.28