what does puppet do when a service's status fails?

edit

The command will depend on the provider that is being used. If you run puppet in debug mode, it'll tell you what commands it is running - e.g. on Centos 7, I get this:

# puppet apply -e ' service { "openstack-keystone": ensure => running } ' -d | grep openstack-keystone
Debug: Executing '/usr/bin/systemctl is-active openstack-keystone'
Debug: Executing '/usr/bin/systemctl start openstack-keystone'

In this case, the provider uses systemctl is-active to figure out whether the service is running, and when it finds that it is not, it tries systemctl start to start it up.

You can override most things by passing attributes to the service resource - this explains how:

https://docs.puppetlabs.com/references/latest/type.html#service-attributes

For example, you could provide a custom start command via:

service { 'openstack-keystone':
  ensure => running,
  start  => '/path/to/startup/script'
}