Submit a ticketCall us

Training ClassSign up for Network Performance Monitor (NPM) and Scalability instructor-led classes

Attend our instructor-led classes, provided by SolarWinds® Academy, to discuss the more advanced monitoring mechanisms available in NPM as well as how to tune your equipment to optimize its polling capabilities. NPM classes offered:
NPM Custom Monitoring and Polling
Orion Platform Scalability

Reserve your seat.

Home > Success Center > Server & Application Monitor (SAM) > SAM - Knowledgebase Articles > How to monitor Orion Module Engine events using the Errors in the Application Event Log template in SAM

How to monitor Orion Module Engine events using the Errors in the Application Event Log template in SAM

Updated November 28, 2018

Overview

This article describes how to monitor events in the Orion Module Engine (SolarWinds.Core.BusinessLayer) using the Errors in the Application Event Log template whenever the service stops running.

Environment

  • SAM 6.7

Steps

The Errors in the Application Event Log template monitors Windows Event logs on a server hosting SAM. Using RPC or WMI, this template can monitor Application Event logs and notify you about the most important events occurring on a server.

The following steps explain how to set up the template for monitoring. 

1. Choose the credentials for monitoring

You can specify credentials or inherit the credentials used to monitor the node on the template to monitor the Windows Event Log.

1-credentials-for-monitoring.png

2. Use WMI or RPC to search for the Application Event log

The component includes two options for collecting the Event logs on a server: WMI (Windows Management Instrumentation) and RPC (Remote Procedure Call). 

WMI is a Windows framework used to query and set values for various operating system and software options. RPC is remote procedure call that allows you to run code remotely on a server

2-fetching-method.png

3. Customize the match definition to look for specific level, source, and event IDs

Here you will configure the corresponding Level, Source and Event ID to match with the Event Viewer.

Below is an example of an Event Viewer displaying the level, date and time, source, and event IDs

3-event-viewer.png

In the Errors in the Application Event Log template, match the log source, event ID, and event type from the Event Viewer.

4-match-definition.png

4. Set the application status for matched Windows events

The application monitor status is determined by:

  • Number of past polling intervals to search for events.  This option will limit the search to the age of the event. If you choose a setting that is too low, the monitor will miss events. If you choose a setting that is too high, the monitor locates old events you may no longer need. 
  • If a match is found in a polling period, component status is.  As the name suggests, you can choose if the status is Up, Down, or Based Event Types/Count whenever there's a match within the polling period

5-number-of-past-polling-intervals.png

 
Last modified

Tags

Classifications

Public