The Event Monitor is the seemonitor.exe Windows service process installed on machines that run a dispatcher and/or SEP services. An event monitor provides administration and management functionality for the SEP and dispatcher services that run on the same machine as the monitor. Typically, event monitors are managed by the system.
When a machine in an installation starts, it registers its Event Monitor with the cross-region database. When you shut down a machine in the installation, it removes this registration from the cross-region database and no further administration action is required.
However when a machine in the installation stops unexpectedly, for example if a process abend causes the machine to stop responding, the event monitor registration is not removed from the cross-region database. As a result, the cross-region database attempts to broadcast events to a non-existent machine.
You can identify this condition by examining the Windows Event Log. The SCOM system manager also identifies this condition. Remove registered event monitor processes where the machine is not running whenever SCOM identifies them. Use the System Event Monitors item to do this.