The attached screen shot of event viewer is from a W2k8 server running OpsMgr, Prot/ProvMgr. I see these security audit message coming in every 15 seconds referencing dfmmonitor.exe. They sem to come in pairs (two at about he same time) and about 15 seconds apart. Also, if I click on each and look at the details It appears the "Port ID:" increments with each occurance. The recent ones were port ID: 56609, 56610, then 50745, 50746, then 50747, 50748.
Does anyone know what these events are indicating and if they should be of concern?