Windows Server Monitoring

Creating a new Windows monitor

Supported Versions: Windows Server 2016 / 2019 / 2022 / 2025 and Windows 8 / 10 / 11.

Prerequisites for monitoring Windows server metrics: Click here

Using the REST API to add a new Windows server monitor: Click here

To create a new Windows server monitor, follow the steps given below:

1. Go to New Monitor and select Add New Monitor.
2. Under Servers, select Windows server.
3. Enter the IP Address or Hostname of the host.
4. Enter the Subnet Mask of the network.
5. Select the OS Type to be monitored.
6. Select the Mode of Monitoring (SNMP or WMI).
   • If SNMP, provide the Port at which it is running (default is 161) and the SNMP Community String (default is 'public'). This requires no user name and password information.
   • If WMI, provide the user name and password information of the server.
7. Select the Enable Event Log Monitoringcheckbox and configure the Log Rules, if you want to monitor Windows Event Logs and fetch their details. Kindly refer Windows Event Log Rules under Admin Activities section for more information. This section deals with the performance metrics displayed for Windows servers.
8. Select the Enable Kerberos Authentication checkbox, if you want to monitor Windows server through Kerberos authentication. However, this is applicable only in WMI mode of monitoring.
9. Select the Perform Application discovery checkbox, if you want to scan your server monitor & add all discovery supported applications running in it.
10. Choose the Monitor Group from the combo box with which you want to associate the Windows server monitor (optional). You can choose multiple groups to associate your monitor.
11. Click Add Monitor(s). This discovers Windows servers in your environment and starts monitoring them.

Monitored Parameters

Applications Manager monitors the critical components of Windows servers to detect any performance problems. These components include CPU, memory, disk, network traffic, etc.

• Availability tab shows the availability history of the Windows server for the past 24 hours or 30 days.
• Performance tab shows some key performance indicators of the Windows server such as physical memory utilization, CPU utilization, response time and swap memory utilization along with heat charts for these attributes. This tab also shows the health status and events for the past 24 hours or 30 days.
• List view tab lists all the Windows servers monitored by Applications Manager along with their overall availability and health status. It enables you to perform bulk admin configurations. Click on the individual monitors listed to view detailed performance metrics. The list view also shows the virtual machines (Windows guest OS) configured in your data center along with their availability and health status.

Applications Manager's Windows server monitoring allows you to view the detailed performance metrics of a Windows server, which are categorized into different tabs:

• Overview
  • Page Memory Usage Statistics
  • Process Details
  • Service Details
• CPU
• Disk
• Network
  • Network Interfaces
  • Network Adapters
  • Firewall Details
  • TCP Connection Stats
• Event Log (only supported in WMI mode)
• Hardware
• NLB
• Scheduled Tasks (only supported in WMI mode)
• Print Queue
• Applications
• Configuration

Overview

This tab provides a high-level overview of the health and performance of the Windows server along with information pertaining to the processes and services running on the system.

Monitor Information

You can use the Custom Fields option in the 'Monitor Information' section to configure additional fields for the monitor.

• The CPU and memory utilization - last six hours graph shows the memory usage and CPU usage values for the last six hours. The attributes shown here are Swap Memory Utilization (in % and MB), Physical Memory Utilization (in % and MB), Free Physical Memory (MB), and CPU Utilization (%).
• The Breakup of CPU Utilization graph provides a break up of metrics for the entire system processor with attributes such as Run Queue, User Time (%), System Time (%), I/O Wait Time (%), Idle Time (%) and Interrupts/sec.

Page Memory Usage Statistics

This section shows information about the page memory usage statistics in Windows servers.

The Page Memory Usage Statistics table displays the following attributes:

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Page Reads/sec	The number of times the pages were read from the disk to resolve hard page faults.
Pages Output/sec	The number of pages that are written to the disk to free up space in physical memory
Pages/sec	The number of pages that are read from or written to the disk to resolve hard page faults

Process Details

This tab shows information about the required processes running in the Windows server. You can add the required processes for monitoring using the Add New Process option. You can also delete unwanted processes and enable/disable reports for specific processes. You can click on any of the attributes listed to view detailed performance stats of that process.

The Process Details tab displays the following attributes:

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Name	The display name of the process.
Process	The name of the process running.
No of Instances	The number of instances running for the process.
CPU(%)	The CPU utilization of the process (in percentage).
Mem(%)	The memory consumption of the process (in percentage).
Handles	The handle count of the process.

Service Details

This tab shows the availability of the required services running in the Windows server. You can add the required services for monitoring using the Add New Service option. You can also stop, start, restart and delete services from within Applications Manager itself.

The Service Details tab displays the following attributes:

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Display Name	The display name of the service.
Service Name	The name of the service running.
Availability	The availability of the service running.

CPU

This tab provides the CPU usage statistics of the Windows server. The tab includes two graphs - one that displays the CPU utilization by CPU Cores and another that shows the Breakup of CPU utilization - by CPU cores. You can view additional reports by clicking the graphs present in the Breakup of CPU Utilization - by CPU cores section. These reports include Break up of CPU Utilization (%) Vs Time, User Time (%) Vs Time, System Time (%) Vs Time, I/O Wait Time (%) Vs Time, Idle Time (%) Vs Time, CPU Utilization (%) Vs Time and Interrupts/sec Vs Time for all the CPU cores.

The CPU tab also shows the following performance metrics:

Parameter	Description	Monitoring Mode
		SNMP	WMI	Agent-based
Core	The name of the CPU core.
User Time(%)	The percentage of time that the processor spends on User mode operations. This generally means application code.
System Time(%)	The percentage of CPU kernel processes that are in use.
I/O Wait Time(%)	The time spent by the processor to waiting for I/O to complete.
Idle Time(%)	The time when the CPU is idle (not being used by any program).
CPU Utilization(%)	Specifies the total CPU used by the system.
Interrupts/sec	The rate at which CPU handles interrupts from applications or hardware each second. If the value for Interrupts/sec is high over a sustained period of time, there could be hardware issues.

You can also view graphs for these attributes by selecting the necessary CPU core and then choosing the appropriate attribute.

Disk

This tab displays the disk usage and disk I/O statistics of the Windows server:

Disk Utilization

Note: The Disk Utilization metrics are supported in all mode of monitoring.

Disk I/O Statistics

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Transfers/sec	Rate of read and write operations on the disk.
Writes/sec	Rate of write operations on the disk.
Reads/sec	Rate of read operations on the disk.
% Busy Time	The percentage of time the disk was busy.
Average Queue Length	The average number of both read and write requests that were queued for the disk during the sample interval.

Note: You can also delete disks that have been physically removed using the Delete Orphaned Disk option.

Network

Network Interface

This table shows details about Network Interfaces.

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Name	The name of the network interface present in the Windows system.
Speed (Mbps)	Current bandwidth of the network interface (in Mbps).
Input Traffic (Kbps)	The rate at which packets are received on the interface (in Kbps).
Output Traffic (Kbps)	The rate at which packets are sent on the interface (in Kbps).
Errors	The number of packets that could not be sent or received.

Note: You can also delete interfaces that have been physically removed using the Delete Orphaned Interface option.

Network Adapter

This table shows details about Network Adapters.

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Name	The name of the network adapter present in the Windows system.
Status	The connection status of the network adapter connected to the network.
Net Enabled	The status of the network adapter.

Firewall Details

This table shows details about the firewall status.

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Firewall Profile	The name of the network profile.
Status	Firewall status of the network profile.

TCP Connection Stats

This table shows details about the TCP Connection Status.

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Active Connections	No. of times TCP connections have made a direct transition from the CLOSED state to the SYN-SENT state.
Established Connections	No. of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT.
Failed Connections	No. of times TCP connections have made a direct transition to the CLOSED state from the SYN-SENT state or the SYN-RCVD state + No. of times TCP connections have made a direct transition from the SYN-RCVD state to the LISTEN state.
Passive Connections	No. of times TCP connections have made a direct transition from the LISTEN state to the SYN-RCVD state.
Reset Connections	No. of times TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-WAIT state.

Event Log

This tab shows information pertaining to the recent Windows events.

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Rule Name	The name of the event log rule.
Log File Type	The type of the Windows event log file.
Source	The source that generated the event.
Event Id	The identifier of the event.
Type	The type of event.
User Name	User name of the logged-on user when the event occurred. If the user name cannot be determined, this will be None.
Description	Description of the event.
Generated Time	The time when the event was generated.

Hardware Metrics

Note: Hardware Monitoring is only supported for Agentless monitoring.

The following are metrics pertaining to the hardware of Dell and HP servers:

Category	Attribute	Description	DELL		HP
			SNMP Mode	WMI Mode	SNMP Mode	WMI Mode
Temperature	Sensor	The name of the temperature sensor.
	Temperature Reading (deg C)	The current /present temperature reading.
	Status	The temperature status - Critical, Warning, and Clear.
Fan	Sensor	Name of the fan sensor.
	Fan Speed (RPM)	The fan speed values displayed in RPM.
	Status	The fan status - Critical, Warning, and Clear.
Power	Sensor	Name of the power supply.
	Reading (Watts)	The power supply reading values displayed in Watts.
	Status	The power status - Critical, Warning, and Clear.
Voltages	Sensor	Name of the voltage supply.
	Reading (Volts)	The voltage reading values displayed in Volts.
	Status	The voltage status - Critical, Warning, and Clear.
Battery	Sensor	Name of the Battery sensor.
	Status	The battery status - Critical, Warning, and Clear.
Memory	Sensor	Name of the Memory sensor.
	Memory Device Type	The type of memory device.
	Size (MB)	The amount of memory currently installed in MB.
	Status	The memory status - Critical, Warning, and Clear.
Disk	Sensor	Identifies the disk's label.
	Device Name	The device name configured for the disk.
	Size (MB)	The allocated size in MB.
	Status	The disk status - Critical, Warning, and Clear.
Array	Sensor	The name of the array disk.
	Bus protocol	The bus type of the array disk.
	Size (MB)	The amount in MB of the used space on the array disk.
	Status	The array status - Critical, Warning, and Clear.
Chassis	Sensor	The user-assigned chassis name of the chassis.
	Model	The system model type for this chassis.
	Status	The chassis status - Critical, Warning, and Clear.
Processor	Sensor	The location name of the processor device status probe.
	Processor Brand	The brand of the processor device.
	Processor Current Speed	The current speed of the processor device in MHz.
	Processor Core Count	The number of processor cores detected for the processor device.
	Status	The processor status - Critical, Warning, and Clear.

Hardware Device-Level Configuration

Hardware Configuration option available under Host Details on the right-hand side of the details page will allow you to opt for the various hardware components you want to monitor. This operation can also be done using the Performance Polling option under the Settings tab which will globally configure the hardware stats.

Advanced Settings

By clicking the Advanced Settings option available under Host Details on the right-hand side of the details page, you can go to the Performance Data Collection page for Servers.

Here you can use the Hardware Health monitoring option to enable or disable hardware monitoring in servers. You can also opt the various hardware components (like power, fan, disk,etc.,) to be monitored by checking the options given. This will globally configure the hardware monitoring status. You can also configure the health status by defining values in the respective text boxes:

• Critical Severity: If the status matches with any of the values defined in the Critical Severity text box, then Applications Manager displays the status of the hardware device as Critical. The values defined by default are failed, error, failure, nonRecoverable, criticalUpper, criticalLower, nonRecoverableLower and critical.
• Warning Severity: If the status matches with any of the values defined in the Warning Severity text box, then Applications Manager displays the status of the hardware device as Warning. The values defined by default are degraded, warning, nonCritical, nonCriticalUpper, nonRecoverableUpper and nonCriticalLower.
• Clear Severity: If the status matches with any of the values defined in the Clear Severity text box, then Applications Manager displays the status of the hardware device is Clear. The value defined by default is 'ok'.

Note: If the status of the device does not match with any of the values defined in the severity text box, the device status is displayed as unknown. Status values defined within the severity text boxes are comma-separated and case-insensitive.

NLB

This tab displays the Network Load Balancing (NLB) information of the Windows server.

Node Information

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Node State	The current state of the node.
Dedicated IP	The dedicated IP address of the node.
Subnet Mask	Subnet mask for the dedicated IP address.
Node Priority	Indicates the priority assigned to the node.
No. of Port Rules	The number of defined port rules for the node.

Cluster Information

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Cluster Name	The name of the NLB cluster.
IP Address	The primary IP address of the cluster.
MAC Address	The Media Access Control (MAC) address of the cluster.
GUID	The Globally Unique Identifier (GUID) of the adapter to which NLB is bound.
No. of Nodes	The total number of nodes available in the cluster.

Other Nodes in the Cluster

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Priority	Indicates the priority assigned to the node.
Dedicated IP	The dedicated IP address of the node.
Display Name	Display name of the node in the form of a Fully Qualified Domain Name (FQDN).

Note: NLB should be enabled and configured in the corresponding server.

Scheduled Tasks

Prerequisites for Scheduled Tasks monitoring:Refer here

The following are the metrics pertaining to Scheduled Tasks:

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Task Name	Name of the scheduled task.
Enabled	Displays if the task is enabled or not.
Last Run Time	The timestamp of when the task ran for the last time.
Last Run Result	The outcome of the last run of the task.
Next Run Time	The timestamp of when the task will run again.
Missed Runs	The number of times the task missed its scheduled execution.
Status	Current status of the task.

You can perform the following actions on the required task(s):

• Delete Task(s): Deletes the selected task(s) from Applications Manager.
• Clear Alarm(s) for Last Run Result: Clears the alarm associated with the Last Run Result attribute for the selected task(s). Moreover, this operation can be audited in Applications Manager, provided the Scheduled Tasks Action checkbox is enabled under Actions dropdown in Settings → Audit Logs.

Scheduled Tasks Monitoring is not supported for Windows servers 2003, 2008 or Windows XP.

Print Queue

Prerequisites for Print Queue monitoring:Refer here

The following are the metrics pertaining to Print Queue:

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
Job ID	The ID used to track the job created in the server.
Owner	Username of the user who submitted the document.
Document Name	Name of the document to be printed.
Pages to print	Number of pages requested to be printed.
Document Size	The size of the submitted document.
Printing Status	Status of the current printing task. Possible states include - Printing, Paused, Error, Deleting, Spooling, Sent to printer, Printed, Offline, Printed and deleted, Waiting, In progress, and Unknown.
Document Wait Time	Time taken for the document to fully print in minutes.
Time Submitted	The time at which the document was submitted.
Printer	The printer chosen for the printing task.

Applications

This tab provides insights into the applications running on the server and their monitoring status.

Configuration

This tab contains information about system configuration attributes.

Parameter	Description	Mode of Monitoring
		SNMP	WMI	Agent-based
SYSTEM INFORMATION
Host Name	The name of the system.
Serial Number	The serial number of the system that represents the service tag of the server.
Manufacturer	The name of the machine manufacturer.
Model	The Product name that a manufacturer gives to the computer.
Domain	The name of the domain to which the system belongs.
BIOS Version	The current BIOS version that is running on the motherboard of the system.
CPU Cores	Total number of processor cores in the system.
Logical Processors	Number of logical processors in the system.
Socket	Number of physical processors available on the system.
OS INFORMATION
OS Name	The name of the operating system instance.
OS Version	The version number of the operating system.
OS Release	The latest service pack installed on the computer. If no service pack is installed, the value will be '-'.
Manufacturer	Name of the operating system manufacturer. For Windows-based systems, this value is "Microsoft Corporation".
OS Installed Date	The date the OS was installed on the system.
Registered User	Name of the registered user of the operating system.
Windows Directory	Windows directory of the operating system.
OS Language	Language version of the operating system installed.
MEMORY INFORMATION
Total Physical Memory (MB)	The total amount of physical memory as available to the operating system.
Total Virtual Memory (MB)	The total amount of area on the hard disk that Windows uses as if it were RAM.
PROCESSOR INFORMATION
ID	Unique identifier of a processor on the system.
Model	The processor model type.
Implementation	The processor family type.
Manufacturer	Name of the processor manufacturer.
Speed (MHz)	The current speed of the processor.
Cache (KB)	Size of the processor cache. A cache is an external memory area that has a faster access time than the main memory.
NETWORK INTERFACE SETTINGS
Name	The name of the network adapter.
IP Address	The IP address configured for this network interface.
Type	The network medium in use.
Mac Address	The Media access control address for this network adapter. A MAC address is a unique 48-bit number assigned to the network adapter by the manufacturer. It uniquely identifies this network adapter and is used for mapping TCP/IP network communications.
Manufacturer	The name of the network adapter's manufacturer.
Status	The current status of the network adapter.
PRINTER SETTINGS
Name	Name of the printer
Server	Name of the server that controls the printer. If this value is not shown, it means the printer is controlled locally.
Type	Denotes whether the printer is controlled locally or remotely.
Default	Indicates whether the printer is the default one. Values are either True or False.
Status	Current status of the printer.
Location	The physical location of the printer.