Documentation forServer & Application Monitor
Monitoring your applications and environment is a key capability of SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) and is available in the Essentials edition. Server & Application Monitor (SAM) is also available in a standalone module.

Real-Time Event Log Viewer

View Windows event logs in real-time using the WMI protocol with the Real-Time Event Log Viewer (RTEV). Event logs can be filtered by log type, event source, and the level of severity.

The viewer allows you to:

  • Start monitoring selected real-time Windows event log entries
  • Pause and restart polling
  • Log in to the selected server with different credentials

Access the Real-Time Event Log Viewer

  1. Click My Dashboards > Applications > SAM Summary.
  2. Select an application from the All Applications widget.

  3. Select Real-Time Event Log Viewer from the Management widget.

    The Real-Time Event Log Viewer opens with a filterable list of all events and logs.

Enable pop-ups so you can display the Real-Time Event Log Viewer.

Filter Real-Time Events

After the events of the selected Log Type are collected and appear in the window on the right, you can filter the results with various criteria.

  1. Select an option from the log type drop-down menu:

  2. Select Custom Sources from the Event Sources drop-down menu. Select only the sources you want to keep when the filter is applied, as highlighted:

  3. Select the type of messages you want the filter to keep by selecting the Event Level.


  4. Click Apply Filter to have the events filtered and displayed.

After filtering is complete, hide and unhide the filtering pane on the left by clicking either of the two arrows, highlighted in red:

The display window shows a list of the most recent events. Should any new events occur while this window is open, a green bar at the top of the window indicates that new events have arrived. Click the green bar to add these new events to the display window.

The Level column icons correspond to the Event Level icons in the legend of the events pane.

Clicking any message in the display window brings up a message box providing the entire message along with additional details.

Monitor events

You can monitor selected events from the Real-Time Event Log Viewer by selecting an event and creating a component monitor:

  1. Select an event and click Start Monitoring in the Message Details view.

    The Add Component Monitor wizard opens with the selection.

  2. Modify the Component Monitor based on the application you selected, following the wizard steps.

    For details, seeUse the Component Monitor Wizard in SAM.

  3. After you begin the Component Monitor Wizard, use the option to Disable Keyword Matching. The Include Events drop-down menu provides options to help you filter results.

  4. Save and assign the component monitor.