## Monitoring the management server

We recommend that you monitor a relatively small set of key services and events on the management server.

Note: | All threshold values are recommendations only. You can adjust these values to fit the standards of your platform.

Note: | Make sure to provide some kind of mechanism for your customers to provide a customized port number if they did not use the default value.

See Monitoring license state on the management server.

See Server monitoring examples.

See Services running on the client and the server.

Table: Monitoring the management server

Data point | Data point description | How to retrieve the data | Notes
--- | --- | --- | ---
Server Status | The status of the main service that runs on the management server. | Use WMI to check whether the semwebsrv service is running on the management server. | The Symantec Endpoint Protection Manager service also runs on the management server, but the Webserver service starts and stops both services, so it is a more reliable indicator of server status.
Link to server console | A direct link to the Symantec Endpoint Protection management server | Default URL is https://​<serverIP>:8443/​​console/apps/sepm | If the server port was customized during installation of the management server, change the port in this URL accordingly. The console provides direct remediation for any issues reported by the RMM tool on the server or the client.
Management server version | Version number of the installed server | Use your standard mechanism for detecting software version numbers. The product name is Symantec Endpoint Protection Manager. | The version number is a four-part string, such as 12.1.6168.6000. A VisualBasic script is provided, as an example only. See VisualBasic script to detect management server version.
Database status | The status of the database process for the management server | For the embedded database: Use WMI to check whether the SQLANYs_sem5 service is running. For a SQL Server database: You must configure the SQL Server database separately. | It is up to you to determine the details for monitoring the SQL Server database.
Content update status on the server | The status of the different Symantec Endpoint Protection content types on the management server | Monitor the most recent events from the Windows Event Log, log name Symantec Endpoint Protection Manager, category Content, in the eventID range 7201 to 7203. If the most recent eventID == 7202, then the content on the server is up-to-date. If the most recent eventID == 7201 or 7203, then the content is out-of-date. | Content status events on the server monitor download and installation success and failure. Content can be up to date only if both download and installation succeed. Installation cannot succeed if download fails, so there is no need to monitor download success directly (eventID 7200). See Content revision state events on the management server.