Applications Systems

How to monitor Orion Module Engine events using the Errors in the Application Event Log template in SAM

This article describes how to use the Errors in the Application Event Log template included in SAM.

First published date

6/3/2019 4:09 PM

Last published date

1/7/2022 5:47 PM

Overview

This article describes how to monitor events in the Orion Module Engine (SolarWinds.Core.BusinessLayer) using the Errors in the Application Event Log template whenever the service stops running.

For more details about that template, see Errors in Application Event Log.

Product section

Server Application Monitor

Resolution

The Errors in the Application Event Log template monitors Windows Event logs on a server hosting SAM. Using RPC or WMI, this template can monitor Application Event logs and notify you about the most important events occurring on a server.

The following steps explain how to set up the template for monitoring. 

1. Choose the credentials for monitoring 

You can specify credentials or inherit the credentials used to monitor the node on the template to monitor the Windows Event Log.

2. Use WMI or RPC to search for the Application Event log 

WMI is a Windows framework used to query and set values for various operating system and software options. RPC is remote procedure call that allows you to run code remotely on a serverThe component includes two options for collecting the Event logs on a server: WMI (Windows Management Instrumentation) and RPC (Remote Procedure Call). 

3. Customize the match definition to look for specific level, source, and event IDs 

Here you will configure the corresponding Level, Source and Event ID to match with the Event Viewer.

Below is an example of an Event Viewer displaying the level, date and time, source, and event IDs

In the Errors in the Application Event Log template, match the log source, event ID, and event type from the Event Viewer.

4. Set the application status for matched Windows events 

The application monitor status is determined by:

  • Number of past polling intervals to search for events.  This option will limit the search to the age of the event. If you choose a setting that is too low, the monitor will miss events. If you choose a setting that is too high, the monitor locates old events you may no longer need. 
  • If a match is found in a polling period, component status is.  As the name suggests, you can choose if the status is Up, Down, or Based Event Types/Count whenever there's a match within the polling period