SAM component monitors
SAM includes predefined component monitors, comprised of code and scripts, that you can use to assess the status and performance of applications, services, processes, and event on nodes throughout your environment.
SAM templates are collections of component monitors that you can assign to nodes as "application monitors" that are also called "applications." A single component monitor can be part of multiple templates. For example, the HTTPS Monitor is included in the following templates:
- AppInsight for IIS
- HTTPS Monitor
- Orion Server 2020.2 - Additional Website
- Orion Server 2020.2 - Main Polling Engine
Note the following details about SAM component monitors:
- Some component monitors have specific port requirements.
- Starting in SAM 2020.2, WinRM is the default polling method by WMI-based component monitors.
- Some component monitors can use Orion agents to collect data.
- Some component monitor do not support polling via Orion Remote Collectors (ORCs). Click here for a list.
The following predefined component monitors are included in SAM:
- DHCP User Experience Monitor
- Directory Size Monitor
- DNS Monitor - TCP
- DNS Monitor - UDP
- DNS User Experience Monitor
- Download Speed Monitor
- Exchange Web Services User Experience Monitor
- File Age Monitor
- File Change Monitor
- File Count Monitors
- File Existence Monitor
- File Size Monitor
- FTP Monitor
- FTP User Experience Monitor
- HTTP Form Login Monitor
- HTTP Monitor
- HTTPS Monitor
- IMAP4 monitor
- IMAP4 User Experience monitor
- JMX Monitor
- LDAP User Experience Monitor
- Linux/Unix Script Monitor
- MAPI User Experience Monitor
- Nagios Script Monitor
- NNTP monitor
- ODBC User Experience Monitor
- Oracle User Experience Monitor
- Performance Counter Monitors
- POP3 Monitor
- POP3 User Experience Monitor
- Process Monitor (SNMP)
- Process Monitors for Windows
- RADIUS User Experience Monitor
- Service Status – SNMP Monitor
- SMTP Monitor
- SNMP Monitor
- SOAP Monitor
- SQL Server User Experience Monitor
- SSL Certificate Expiration Date Monitor
- TACACS+ User Experience Monitor
- TCP Port Monitor
- Tomcat Server component monitors in SAM
- VMware Performance Counter Monitor
- Web Link Monitor
- Windows Event Log Monitors
- Windows PowerShell Monitor
- Windows Script Monitor
- Windows Service Monitors
- WMI Monitors
Can't find a component monitor to suit your needs? Use the Component Monitor Wizard to create custom monitors for specific processes, performance counters, or services. You can also use API pollers to gather metrics for nodes; see Monitor metrics via external APIs in SAM.
Orion server port requirements for component monitors
Microsoft Windows uses a random port between 1024 and 65535 for WMI communications, by default, so you must create firewall exceptions to allow bidirectional TCP/UDP traffic on those ports to support SAM component monitors and application monitoring templates that use WMI.
Starting in SAM 2020.2, WinRM is the default polling method for WMI-based component monitors to gather data from target nodes for assigned application monitors. A fallback mechanism automatically switches to legacy RPC/DCOM polling, if necessary. Component monitors that use WinRM require a single open port: 5985 (HTTP) or 5986 (HTTPS)
The following table outlines port requirements for SAM component monitors.
| Component monitor | Port | Port type |
Notes |
|---|---|---|---|
| DHCP User Experience Monitor | See Notes. | UDP |
For DHCP requests, the default port is 67 (IPv4) or 547 (IPv6). For DHCP responses, the default port is 68 (IPv4) or 546 (IPv6). |
| Directory Size Monitor |
See SAM WMI requirements. Starting in SAM 2020.2, WinRM is the default polling method for WMI-based component monitors, which uses port 5985 (HTTP) or 5986 (HTTPS). |
||
|
DNS Monitor DNS User Experience Monitor |
53 | TCP/UDP | Used for DNS queries. |
| Download Speed Monitor | 19 | Used for the character generator service. | |
| ESX Hardware Monitoring | 5989 | Used to collect vCenter data via API. | |
|
File Age Monitor File Change Monitor File Existence Monitor File Size Monitor File Count Monitor |
445 |
See SAM WMI requirements and Poll devices with SolarWinds Orion agents. Starting in SAM 2020.2, WinRM is the default polling method for WMI-based component monitors, which uses port 5985 (HTTP) or 5986 (HTTPS). |
|
|
FTP Monitor FTP User Experience Monitor |
21 | Used for FTP sessions. | |
|
HTTP Form Login Monitor HTTP Monitor TCP Port Monitor |
80 | Used for HTTP form-based login sessions. | |
| HTTPS Monitor | 443 | Used to test a web server's ability to accept incoming sessions over a secure channel and then transmit the requested page. | |
| IMAP4 Monitor | 143 (default) | IMAP4 | Used for IMAP 4 sessions. |
| 585 | IMAP4 | Used for Secure IMAP (IMAP4-SSL) sessions. | |
| 993 | IMAP4 | Used for IMAP4 over SSL (IMAPS) sessions. | |
| IMAP4 User Experience Monitor | 25 | SMTP | Used to communicate with a Microsoft Exchange mail server. |
| 143 | IMAP4 | ||
| 993 | IMAP4 | ||
| LDAP User Experience Monitor | 389 | Used for LDAP connections. | |
| 636 | For LDAP over SSL, use port 636. | ||
| Linux/Unix Script Monitor Ports | 22 | Used for SSH connections. | |
| NNTP Monitor | 119 | UDP | Used for Network News Transfer Protocol (NNTP) connections. |
| ODBC User Experience Monitor | 1630 | TCP |
To configure ODBC to use the Orion Agent for Linux, see Linux/Unix system configurations for component monitors. |
| Oracle User Experience Monitor | 1521 | TCP | The Oracle SQL*Net Listener allows Oracle Client connections to the database over Oracle's SQL*Net protocol. You can configure it during installation. To reconfigure this port, use Net Configuration Assistant. |
| 1526 | |||
| Performance Counter Monitor | See Description. | TCP |
This monitor uses RPC, requiring the following ports:
|
| POP3 Monitor | See Description. |
This monitor uses the following ports to communicate with Microsoft Exchange mail servers:
|
|
|
POP3 Monitor POP3 User Experience Monitor |
110 (default) | Used for POP3 connections. | |
| 995 | Used for Secure POP3 (SSL-POP) connections. | ||
| 25 | SMTP | Used for SMTP sessions. | |
| Process Monitor |
SNMP |
Uses SNMP communication. |
|
| Process Monitor - Windows |
|
Uses WMI (see SAM WMI requirements) or RPC communication to test if a specified Windows process is running and reports statistics about all instances of the process. Starting in SAM 2020.2, WinRM is the default polling method for WMI-based component monitors, which uses port 5985 (HTTP) or 5986 (HTTPS). |
|
| RADIUS User Experience Monitor |
1812 1645 |
Used to authenticate RADIUS protocols, along with port 1813. Cisco devices may require port 1645 or 1646. |
|
| RWHOIS Port Monitor | 4321 | Used to test the ability of a Referral Whois (RWhois) server to accept incoming sessions. | |
| SMTP Monitor | 465 | SMTP | Used for Secure SMTP (SSMTP). |
| SNMP Monitor | 444 | SNMP | Used to test the ability of an SNMP server to accept incoming sessions. |
| SQL Server User Experience Monitor | 1433 | Requires 1433, the standard port for SQL Server. If SQL Server utilizes a different port, use the ODBC User Experience Monitor to manually define a connection string for the port instead. | |
| TACACS+User Experience Monitor | 49 | Used for TACACS+ protocol connections. | |
| Tomcat Server Monitor | 8080 | Retrieves status information from the Apache Tomcat status website. | |
| VMware Performance Counter Monitor | 443 | Used to communicate with the VMware API. | |
| Windows Event Log Monitor |
Uses the following ports:
|
SAM WMI port requirements
Microsoft Windows uses a random port between 1024 and 65535 for WMI communications.
If you're using SAM 2019.4 or earlier, you may need to create firewall exceptions to allow bidirectional TCP/UDP traffic on those ports to support SAM templates and component monitors that use WMI.
Note the following details about WMI and SAM:
- Starting in SAM 2020.2, WinRM is the default polling method for WMI-based component monitors.
- 5985 (HTTP) or 5986 (HTTPS)
- If using SAM 2019.4 or earlier and wide ranges of open ports on the firewall present security concerns in your environment, you can either:
- Upgrade to SAM 2020.2 to leverage WinRM polling, or
- Use Orion agents for polling.
- If necessary, use WBEMTest to check remote WMI connectivity of target servers.
The following component monitors use WMI:
- Performance Counter Monitor
- Process Monitor – WMI (if script uses WMI access)
- Windows Event Log Monitor
- Windows PowerShell Monitor (if script uses WMI access)
- Windows Script Monitor
- Windows Service Monitor (if script uses WMI access)
The following SAM templates use WMI:
- Active Directory 2003-2008 Services and Counters
- Active Directory 2008 R2-2012 Services and Counters
- Active Directory 2016 Domain Controller Security
- Active Directory 2016 Services and Counters
- APC PowerChute Agent (Windows)
- Blackberry Enterprise Server
- Citrix XenApp 5.0 Core WMI Counters*
- Citrix XenApp 5.0 ICA Session WMI Counters*
- Citrix XenApp 5.0 Presentation Server WMI Counters*
- Citrix XenApp 5.0 Services*
- Citrix XenApp 6.0 Core Counters*
- Citrix XenApp 6.0 ICA Session
- Citrix XenApp 6.0 Services
- Citrix XenApp and Xen Desktop 7.x (Advanced)
- Citrix XenApp and Xen Desktop 7.x (Events)
- Citrix XenApp and Xen Desktop 7.x (Performance Counters)
- Citrix XenApp and Xen Desktop 7.x (Services)
- Directory Size
- Errors in Application Event Log
- Exchange 2007 templates (all)
- Exchange 2007-2010 templates (all)
- Exchange 2010 templates (all)
- Exchange 2013 templates (all)
- Exchange 2016 templates (all)
- Exchange Active Sync Connectivity
- Exchange Server 2000 and 2003
- Exchange Web Services User Experience monitor
- Internet Information Services (IIS) 6
- Internet Information Services (IIS) 10
- Kaspersky Security Center Antivirus
- Kiwi Syslog Server
- Microsoft DirectAccess templates (all)
- Microsoft Dynamics templates (all)
- Microsoft Forefront Endpoint Protection templates (all)
- Microsoft IIS SMTP Server
- Microsoft Lync Server templates (all)
- Microsoft Message Queuing templates (all)
- Microsoft Network Policy Server templates (all)
- Microsoft Office 365 templates (all)
- Microsoft Routing and Remote Access templates (all)
- Microsoft SharePoint templates (all)
- Microsoft Skype templates (all)
- Microsoft SQL Server templates (all)
- Microsoft Windows Internet Name Service (WINS) templates (all)
- Microsoft Windows Server templates (all)
- Orion Server 2017.3
- SQL Server 2005 Database
- SQL Server 2008 Database
- Symantec Backup Exec Remote Agent
- Symantec Backup Exec Server
- Symantec Endpoint Protection Server
- Symantec NetBackup Client
- Trend Micro OfficeScan Client
- Trend Micro OfficeScan Server
- Windows DHCP Server
- Windows DNS Server
- Windows Network Load Balancing
- Windows Print Services
- Windows Remote Desktop Services (Session Host Role)
- Windows Server 2003-2008
*These templates were deprecated in SAM 2020.2 but are still available in THWACK.
Learn more
- Common SAM template elements (SolarWinds Lab Bits video)
- FIPS compliance in SAM
- SAM Custom Template Guide (Learn how to use component monitors in PowerShell, Nagios, Linux/Unix, and Windows scripts.)
- SAM Application Monitor Template Reference (Learn about component monitors included in predefined templates)
- Use PowerShell in SAM templates, application monitors, and component monitors
- Use properties and variables in SAM application monitors and component monitors in alerts
- Use script component monitors in SAM