Application monitors causing high CPU alerts

ttl

I'm curious how one is supposed to implement Application monitors without actually triggering the High CPU alert they're looking for.

Example:

We are running the Windows Server 2008 Domain Controller Security template against one of our DC's. This App monitor contains some 21 component monitors, many (most?) of which search the Event Log on the DC. When these run it spikes the CPU on the DC up to 90-100% until the polls are finished, and about 1/3 of them timeout and don't report any data (i.e. they show up as grey Unknown icons.) This is a dual-core, 4GB DC.

On top of this, if we run any other Application monitors (like Windows Server 2003-2008 Services and Counters) on the same DC, even if we try to space out the polls so that the two monitors do not run at the same time, it effectively pegs the CPU on the DC for most of the day, adversely impacting performance.

How is this supposed to work effectively?

aLTeReGo

It sounds like you may have hundreds of thousands, or possibly millions of events in your event logs. You may want to consider reducing the your event log retention period, or leveraging the Windows Event Log Forwarder to send these events to the Orion server. I can say that my server has just under 100,000 events and I'm not experiencing excessive CPU utilization with the Windows Event Log Monitor. The Windows Event Log Monitor utilizes WMI to query the results from the server, how many CPU resources are consumed by the query are dependant upon the number of records and the performance of the server. Since the server sounds to be reasonably sized it's likely that sorting through the number of events in the log that are what's causing the high CPU usage.

Try exporting/saving then delete the event logs for each category type (Application/System/Security) and see if this significantly reduces the CPU resource utilization, and improves the reliability of these monitors.