Documentation forServer & Application Monitor
Monitoring your applications and environment is a key capability of Hybrid Cloud Observability and is also available in a standalone module, Server & Application Monitor (SAM). Hybrid Cloud Observability and SAM are built on the self-hosted SolarWinds Platform.

Directory Size Monitor

As described in Work with SAM component monitors, SAM includes several "component monitor types" that use various methods to focus on elements such as services, logs, or processes. Directory Size Monitors are component monitors that determine the disk space used by the files in a directory, optionally including all subdirectories.

For example, the Kiwi Syslog Server template includes a Directory Size: Web Server Application Data Folder component monitor that tracks the size of a folder. If the contents of a folder grow past a threshold, you need to investigate the situation.

In SAM, Directory Size Monitors use WinRM to collect data if WinRM polling is enabled on the SolarWinds Platform server and agentless target nodes. See Use WinRM as the default polling method for WMI-based component monitors in SAM.

Note the following details that apply to component monitors categorized as Directory Size Monitors:

  • Access to WMI or Windows file share on target machine is required.
  • The returned statistic is the disk space used in bytes.
  • Files that do not match the File Extensions Filter are not included in the disk space calculation.
  • It may be difficult to monitor the size of a folder containing hundreds or thousands of files because the process may timeout before the target server finishes computing the file sizes and sends the response.
  • When you switch between agent-less monitoring and SolarWinds Platform agents, you need to manually establish the correct path for monitoring. The file path in UNC format will not work on a Linux/Unix-based computer. See Configure Linux/Unix systems for monitoring by the SolarWinds Platform agent in SAM.

If you create a Directory Size Monitor in the Component Monitor Wizard, you'll be prompted to provide several values, as described next.

Field descriptions


A default description of the monitor. To override the default description, add to or replace existing text. Changes are automatically saved. The variable to access this field is ${UserDescription}.

Customize descriptions to specify what will be monitored so related alerts and notifications are more meaningful later.

Enable Component

Determines if the component is enabled. Disabling the component leaves it in a deactivated state that does not influence its application availability or status, as displayed in the SolarWinds Platform Web Console.

Credential for Monitoring

Select a credential with read access to the file or use the <Inherit credential from node> option. If the credential you need is not in the credentials list, add it in the Credentials Library. See Understand the Credentials Library for details.

WinRM Authentication Mechanism

If the SAM WinRM toggle is enabled for application polling on the SolarWinds Platform server and target nodes, select an authentication method for the connection. The default setting is Negotiate.

  • Default: Specifies the transport to use for WS-Management protocol requests and responses: HTTP or HTTPS. The default is HTTP.
  • Digest: User name and password are required. The client sends a request with authentication data to an authenticating server, usually a domain controller. If the client is authenticated, then the server receives a Digest session key to authenticate subsequent requests from the client.
  • Negotiate: The client sends a request to the server to determine the protocol to use for Simple and Protected Negotiation (SPNEGO) authentication, which can be either:
    • Kerberos for domain accounts, or
    • NTLM for local computer accounts
  • Basic: User name and password are required, as sent via HTTP or HTTPS in a domain or workgroup.
  • Kerberos: User name and password are required for mutual authentication between the client and server, using encrypted keys. The client account must be a domain account in the same domain as the server. When a client uses default credentials, Kerberos is the authentication method if the connection string is not one of the following: localhost,, or [::1].
  • NtlmDomain: User name and password are required for NTLM authentication. The client proves its identity by sending a user name, password, and domain name.
  • CredSssp: User name and password are optional. The Credential Security Support Provider (CredSSP) lets an application delegate the user credentials from the client to the target server for remote authentication. The client is authenticated over the encrypted channel by using the SPNEGO protocol with either Kerberos or NTLM.

    Portions excerpted from the WinRM Glossary (© 2020, Microsoft Corp., available at

Full Directory Path

Specify the path to the monitored directory using Universal Naming Convention (UNC) format. For example: \\computername\c$\logfiles\. The path can include the variable ${IP} to represent the target node IP address.

File Names Filter

Use this text-matching filter to specify files to include in disk space usage calculations, based on the file name. You can specify multiple file names (or partial names) separated by commas or spaces. This field supports an asterisk (*) as a wildcard character. To include all files, specify *.

File Extensions Filter

Specify files to include in disk space usage calculations based on the file extension. Separate multiple file extensions with a comma or space.

Example for counting all files, regardless of file extension
File Extensions Filter: *

Example for counting files with .exe, .dll, and .bat extensions
File Extensions Filter: exe, dll, bat.

Include Subdirectories

Determines if the contents of subdirectories are included in the disk space usage calculations for the directory size.

Convert Value

Select the "Yes, convert returned value" option to display fields where you can select a common function or enter a custom formula. The Custom Conversion option provides basic arithmetic operators (+, -, *, /), plus built-in mathematical functions for more advanced conversions. See Convert values in data transformations for SAM component monitors.

Statistic Threshold

Specify a threshold that indicates when a warning or critical level is breached. You can use logical operators (for example: Less than 15 for warning and Less than 5 for critical) or set specific values. See Application Monitor Thresholds.

User Notes

Add notes for easy reference. You can access this field by using the variable, ${UserNotes}.