Applications Systems

SAM Linux Process Monitor shows false down when service is operationally up in linux server

A SolarWinds SAM Process Monitor on Linux can report a false down state when the configured Process Name matches the Linux service/unit name instead of the actual running executable. This occurs because Process Monitor checks for a running process, not the systemd service label. Validate the real process with Linux commands such as systemctl status, systemctl show -p MainPID, pgrep, and ps, then update the monitor to use the correct process name.

First published date

7/7/2026 6:33 PM

Last published date

7/7/2026 6:33 PM

Overview

This article explains a Linux SAM Process Monitor behavior where an application monitor shows down even though the Linux service is active.

In Linux, the following values are not always the same:

  • service name shown by systemctl

  • executable launched by the service

  • helper or child process names

A SAM Process Monitor evaluates the configured process match. If the configured Process Name does not match the actual running process on the target node, SolarWinds can show a false down state even when the Linux service is active.

Product section

Server Application Monitor

Cause

The SAM component type is Process Monitor, which checks for a running process and not the Linux service label.

On Linux, the service name and actual executable name may differ. If the configured Process Name does not match the real running executable, the monitor can report false down. This can also occur when one server exposes a parent process and another exposes a helper or child process, or when process naming differs by package version, distro, or implementation.

Resolution

  1. Confirm the failing component is a Process Monitor. (Settings>All settings>SAM settings>Manage template)

  2. Review the configured "Process Name" in Process Monitor

  3. On the affected Linux host, verify the live service state:

    Note: Replace <service-name> with the Linux service/unit name shown in systemctl

     systemctl status <service-name>
 systemctl is-active <service-name>
 systemctl show <service-name> -p MainPID

  4. Identify the actual running process:

     pgrep -a -f <application-keyword>
 ps -ef | grep -i <application-keyword>
 ps -fp <MainPID>
 sudo readlink -f /proc/<MainPID>/exe

  5. Compare the SolarWinds Process Name with the actual running executable.

  6. If the service name and process name differ, update the Process Monitor to use the actual running executable.

  7. Save the monitor and click Poll Now.

  8. Confirm the application/component changes to green and remains stable on subsequent polls.

  9. If only some nodes use a different process layout, create a separate Process Monitor or application template for those nodes and remove them from the original monitor assignment if needed.