Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Browsing all 5385 articles
Browse latest View live

Re: Network Devices Node Ip and node name disapeared

When did this start? Is your console and appliance the same version? Internally we do use unique IDs for nodes that look like that, but they shouldn't be appearing in your console.

View Article


Re: LEM Reporting - How to build reports on explicit data-sets?

Nicole; you are correct!  I just tested this and it seemed to work.  Please feel free to un-mark my answer as correct, thanks for the info!

View Article


Re: LEM Reporting - How to build reports on explicit data-sets?

It could certainly be more intuitive - maybe a quick howto on this would be helpful, it's the most common use case for "custom" reporting.

View Article

Alert DB of the Database Maintenance Report

Hi,   I am trying to get a good grasp on how far back I can search/report LEM Events.  Using the LEM Reports Console, the most recent Database Maintenance Report display 205 in Alert DB section.  My...

View Article

Re: LEM Reporting - How to build reports on explicit data-sets?

PS: I un-marked your answer as correct if you want to pick a new one

View Article


Image may be NSFW.
Clik here to view.

Re: Prevent mass file operations?

colby, thanks for the clarification. I'm testing out this ability now but I seem to be having some trouble. I created a test group in Active Directory and created a NewGroupMember rule to: E-mail me if...

View Article

Re: Collect Raw Logs

Be aware when you do this that when you search it in nDepth it will all be "typed" with that connector, so you just need to know what you're looking for. I usually use one that I DON'T already have so...

View Article

Re: How do you export a list of the current rules?

If you use the LEM "Audit - Internal Audit Report" you should be able to see which rules have been changed and by which user.  That doesn't tell you WHAT was changed, or which rules are currently...

View Article


Re: Forward LEM events to another SYSLOG.

There currently isn't - the best thing you could do is forward your devices to an intermediary syslog server then forward that to LEM and your secondary host.

View Article


Re: Alert DB of the Database Maintenance Report

This KB might help: SolarWinds Knowledge Base :: How many days of live data will the LEM database store?

View Article

Re: Success Stories of gaining operational value from LEM

One of our challenges is that we have limited VPN access licenses. Knowing who and when gaining works for us on two levels. 1. Find out who is on and for how long 2. Our auditors love it!!!

View Article

Re: Prevent mass file operations?

AmitGreat points... but... how do you handle users giving their notice and then going about a "cleanup"? (in other words... active monitoring).Further... a look back on users who left.. but cleaned up...

View Article

Re: Prevent mass file operations?

Thanks for the suggestions. Tried both IP address and FQDN but still got the same results. Any other ideas?

View Article


Re: Prevent mass file operations?

What it's going to do is try to match the FQDN/hostname/IP to a system in Manage>Nodes. You might cross reference the agent list there to make sure things look right.

View Article

Re: Prevent mass file operations?

Understood. I checked that earlier when testing it out. However, I went back and tested the rule again with both the IP address and FQDN of the domain controller as it's displayed in the list of nodes....

View Article


Image may be NSFW.
Clik here to view.

Re: How do I create a filter in the monitor for connector profiles?

This is what I wanted, thank you! I had forgotten to get "InsertionIP" to show up, you had to first select "Any Alert." Thank you very much!

View Article

Re: Collect Raw Logs

So, I assume the use case here is clear and that while this can be done, the solution is less than optimal.  Is there something in the works to hopefully make this type of thing easier and perhaps more...

View Article


Re: Collect Raw Logs

We just don't see a ton of people using the raw log support, so it's not something we've focused on. There's nothing in the near term that will change this explicitly (either by documentation, by...

View Article

Image may be NSFW.
Clik here to view.

Re: Collect Raw Logs

A better solution would let you input those things and be more like the "generic" connectors we've discussed on and off (that's kind of what this is anyway). But again... no promises I agree this would...

View Article

Image may be NSFW.
Clik here to view.

LEM 6.1.0 new nodes

With LEM 6.1.0  Can you easily see new nodes or workstations on your network that do not have the LEM agent installed?

View Article
Browsing all 5385 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>