Submit a ticketCall us

WebinarVisual Monitoring Tactics: Getting More Log Search Value from SolarWinds Log & Event Manager with nDepth Webcast

Do things seem to make more sense when they are visualized? Are you an IT professional or security expert with a wish for more cybersecurity tools that provide an intuitive visual experience? Join Alexis Horn and Jamie Hynds from SolarWinds as they demonstrate how the nDepth feature in LEM can help make visualizing log search results a reality.

Register now.

Home > Success Center > Server & Application Monitor (SAM) > SAM - Knowledgebase Articles > Windows process and service probe status resolution (both WMI and RPC)

Windows process and service probe status resolution (both WMI and RPC)

Table of contents
Created by Lori Krell_ret, last modified by carolyn.mazenko on Jun 15, 2018

Views: 1,358 Votes: 0 Revisions: 8

Updated June 15, 2008


You can configure monitoring of processes or Windows services using both WMI and RPC. Additionally, you can override resolution of the probe when the process or service is not running to be in "Down" or "Not running" status. This article explains different scenarios and how they apply to the application status. This document extends the Orion process component user documentation.


There are three similar component monitors, which may be used to monitor running process/service:

  • Process monitor - Windows: Based on process name or process image path allows identify, if process is running or not and translate it to component status (no thresholds).
  • Windows service monitor: The same usage and options as Process monitor, but for Windows services
  • Service status - snmp: Uses only snmp as polling technology. Service status is reported as monitor statistic data value (e.g. number). Allows to configure threshold based on the status number. Doesnt allow override status resolution and is not covered in this document.


These two components allow to configure following options, which are changing behavior of the component:

  • Fetching method: Use different polling technology, independently on Node type. Both fetching methods have the same resolution of status.
  • Status When Process is Not Running: Allows to force the component final status, if the monitor detects service or process in not running status.


  • SAM


Using "Status When Process is Not Running", user is able to change status resolution of the component. Default value is "Not running". The option applies to both fetching methods (RPC/WMI) and only in case the process or service is detected in one of not running statuses. This allows following scenarios:

  • Customer wants to monitor critical service and needs mark the application down e.g. in case the service is restarting.
  • Customer needs to reinstall one not important application (process), but doesn't want to mark the application as "Down".

The following table summarizes the default behavior in SAM 6.2.x:

Component Polled Status SAM 6.2.x (without "Status When Process is Not Running" option)
Process Not found Down
Windows Service Not found Down
Windows Service Not running (and all related Starting, Stopping, inc) Not running

In SAM 6.3, the option overrides all possible scenarios for both service and process and final status fully respects value selected in this option.




Last modified