Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: LEM events

$
0
0

There are a several things to check for:

1) Check the logs on the agent device.  For windows it's in /contego.   In should say 'connected' during the last connection attempt.  If it says 'disconnect' or 'unable to connect' - there is something wrong.

   a) first step is to just reinitialize the agent.

        1)  stop the solarwinds lem agent service

        2) delete the spop log and the spop directory

        3) start the solarwinds lem agent service

        4) keep an eye on the log - it should show a bunch of messages, but the one to look for is 'connected'

2) Validate the ports are open (37890-37892: traffic from LEM agent to LEM manager)

3) Check for excessive queuing at the agent

4) SSH into LEM

    a) look at the watchlog (cmc::cmm#watchlog), you can also use showlog - to see if the agent is trying to connect

    b) also look at the rrc:>pumpstatus to check if the database is connected and if there is excessive waiting time for database items to be processed

 

There are other things you can check, depending on what you find in the above steps.

 

Thanks

Amit

Loop1 Systems


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>