Orion - Windows Service Monitoring - WMI Vs. RPC

This is an age old question that has no simple answer. RPC is more resource intensive (CPU/Bandwidth/etc.), but can under certain circumstances be faster than WMI. The reverse can also be true under certain circumstances. WMI is light weight in comparison to RPC, but has limits on the number of simultaneous queries and connections that can be made to a single host. This can cause serialization to occur which can delay polling. This normally only manifests itself when polling a lot of information via WMI at high frequency. There really is no right or wrong answer. It really comes down to what works best in your environment. This is why we provide both as options within SAM for most every Windows component monitor type.

Also, you can't monitor Eventlog with RPC, and you can't restart services if you are monitoring them with RPC. So there's a couple of trade-offs.

In our environment we really try to monitor with SNMP for the base stuff, and then go straight to WMI for the application monitoring. We've decided (for the moment) to monitor nodes with WMI (versus SNMP) only in cases where we need Windows Virtual Moutn Points or to get the IOPS calculations.

Leon Adato, I'm afraid you are mistaken. SAM's Windows Event Log Monitor does in fact allow you to monitor Windows Event Logs via RPC. This was added in SAM 5.5. You can also stop/start/restart services and kill processes that are monitored via RPC.

One of those times I'm delighted to be wrong. I had tried testing this out a couple of weeks ago, but I was obviously rushed and not doing it properly. Thanks for the clarification!