$ 0 0 The LEM agent will get information about process and service events from the Windows event logs by default assuming that your audit policies are set to generate those events.