Submit a ticketCall us

AnnouncementsAre You “Flying Blind?”

When it comes to your complex IT infrastructure, you want to ensure you have a good grasp of what’s going on to avoid any fire drills that result from guesswork. Read our white paper to learn how proactively monitoring your IT environment can help your organization while giving you peace of mind.

Get your free white paper.

Home > Success Center > Server & Application Monitor (SAM) > SAM - Knowledgebase Articles > How to monitor Orion Module Engine events using the Errors in the Application Event Log template in SAM

How to monitor Orion Module Engine events using the Errors in the Application Event Log template in SAM

Updated November 28, 2018


This article describes how to monitor events in the Orion Module Engine (SolarWinds.Core.BusinessLayer) using the Errors in the Application Event Log template whenever the service stops running.


  • SAM 6.7


The Errors in the Application Event Log template monitors Windows Event logs on a server hosting SAM. Using RPC or WMI, this template can monitor Application Event logs and notify you about the most important events occurring on a server.

The following steps explain how to set up the template for monitoring. 

1. Choose the credentials for monitoring

You can specify credentials or inherit the credentials used to monitor the node on the template to monitor the Windows Event Log.


2. Use WMI or RPC to search for the Application Event log

The component includes two options for collecting the Event logs on a server: WMI (Windows Management Instrumentation) and RPC (Remote Procedure Call). 

WMI is a Windows framework used to query and set values for various operating system and software options. RPC is remote procedure call that allows you to run code remotely on a server


3. Customize the match definition to look for specific level, source, and event IDs

Here you will configure the corresponding Level, Source and Event ID to match with the Event Viewer.

Below is an example of an Event Viewer displaying the level, date and time, source, and event IDs


In the Errors in the Application Event Log template, match the log source, event ID, and event type from the Event Viewer.


4. Set the application status for matched Windows events

The application monitor status is determined by:

  • Number of past polling intervals to search for events.  This option will limit the search to the age of the event. If you choose a setting that is too low, the monitor will miss events. If you choose a setting that is too high, the monitor locates old events you may no longer need. 
  • If a match is found in a polling period, component status is.  As the name suggests, you can choose if the status is Up, Down, or Based Event Types/Count whenever there's a match within the polling period


Last modified