Choose component monitors and application monitor templates based on protocol
If working with a SAM application monitor template or component monitor that can return values using different protocols, consider the following guidelines based on the protocol.
- SNMP is the best protocol to use from the reliability and speed perspective. It is much faster and more reliable than both Performance counters and WMI, with the lowest impact on system performance.
- WMI calls can sometimes take a relatively long time, with significant overhead.
Starting in SAM 2020.2, WinRM is the default transport method for WMI-based component monitors.
RPC vs. WMI
The reason some SAM templates use RPC is because it is generally considered more reliable, uses overheard so it's faster than WMI, and is firewall friendly. There are distinct advantages and disadvantages to both RPC and WMI, which is why SAM utilizes both methods to retrieve information.
RPC is an open standard, client/server model that initiates a procedure on one device (the client), and then the procedure process and return information comes from another device (the server). To do this, RPC needs to locate the remote server, connect to it, authenticate and make a request the server can understand and process. When the server responds, the client considers the call complete and continues processing the information it received.
To monitor Windows Performance Counters over RPC, the user account must either belong to an Administrators group or the Performance Monitor Users group in Windows.