Answer

PROBLEM

The GFI EventsManager active monitoring check for a Physical machine (Physical event source) and looks at the virtual memory not physical memory.
 

ENVIRONMENT

GFI EventsManager
All Supported Environments
 

SOLUTION

This is a known issue and a patch for GFI EventsManager server is available to solve it.
 
Provide the following instructions to a customer experiencing this issue:

1. Download the patch file: http://psg.gfi.com/esm/Patches/gfi.NSM2012.Core.zip
2. Close the GFI EventsManager Console
3. Stop the following GFI EventsManager services, using services.msc:

• GFI EventsManager Monitor
• GFI EventsManager
• GFI Database Server 2.1

1. Create a backup of directory C:\Program Files (x86)\GFI\EventsManager13\
2. Extract the file downloaded in step 1 into the installation directory, replacing the gfi.NSM2012.Core.dll file with the one from the downloaded zip file
3. Start the GFI EventsManager services previously stopped
4. Open the GFI EventsManager Console