Documentation forServer & Application Monitor
Monitoring your applications and environment is a key capability of Hybrid Cloud Observability and is also available in a standalone module, Server & Application Monitor (SAM). Hybrid Cloud Observability and SAM are built on the self-hosted SolarWinds Platform.

Errors in Application Event Log

Assign this SAM application monitor template to a Windows node to set the state of the application to Down if there are any errors in the last five minutes of the Windows Application event log.


WMI access to target server.


Windows Administrator on target server.

Component monitors

Click a link to learn more about a component monitor included in this template.

DHCP User Experience Monitor

This component monitor measures how long it takes to get a lease from a Dynamic Host Configuration Protocol (DHCP) server. It verifies that the DHCP server responds with an IP address, but neither confirms nor accepts the lease.

This component monitor uses the following ports:

  • For the DHCP request, the default UDP port is 67 (IPv4) or 547 (IPv6).
  • For the DHCP response, the default UDP port is 68 (IPv4) or 546 (IPv6).

Directory Size Monitor

This component monitor determines the disk space used by the files in a directory, optionally including all subdirectories.

Windows Event Log Monitor

This component monitor can use both WMI and RPC communication to scan Windows Event Logs for recent events matching your defined criteria. Events are considered recent based on the age of the event as compared to the application polling frequency. If a matching event is found, the component monitor changes status.

The component monitor eventually returns to its original status as time passes so you may not notice a matching event unless you create an alert to email you when the component goes down.

This component monitor uses the following ports:

  • TCP/135
  • RPC/named pipes (NP) TCP 139
  • RPC/NP TCP 445
  • RPC/NP UDP 137
  • RPC/NP UDP 138