From OpenNMS

Services are monitored slightly differently to nodes. Custom pollers check specific features of the protocol they're designed to monitor, and ensure that the service is responding correctly. A more generic TCP/IP poller can simply check that some process is listening on a given TCP port, which is often sufficient to test less common services without a specific custom poller. As of version 1.6, the following custom protocols can be monitored:

   * Citrix
   * DHCP
   * DNS
   * Domino IIOP
   * FTP
   * HTTP
   * HTTPS
   * IMAP
   * JBoss
   * JDBC
   * JMX
   * LDAP
   * MX4J
   * NRPE
   * NSClient
   * NTP
   * OMSAStorage
   * POP3
   * Radius
   * SMTP
   * SNMP
   * SSH 

Further, some more complex pollers exist which check at a higher level than just a protocol:

   * DiskUsage (checks free space on disks using SNMP)
   * MailTransportMonitor (checks that e-mail is able to pass completely through a mail system)
   * PageSequence (checks a simple sequence of HTML pages accessed by HTTP)
   * PERC (checks PERC Raid controllers, as supplied in Dell servers)
   * Win32Service (checks to see if windows services are running, using SNMP)    

In addition, a General Purpose poller can be used to run an arbitrary external script or program. This external function does whatever is necessary to check for service availability and outputs a 1 (for service up) or 0 (for service down).

Escalation

When a service is found to be down, it is possible that this is the first indication that the node is having serious difficulties. Therefore at such time, the node is rechecked (by ICMP ping). If the node is found to be down, then the Service Down event is suppressed, and a Node Down generated instead as it has more meaning.