What happens to incoming log data when SEM is down?

11/8/2018 8:02 PM

11/8/2018 8:02 PM

This article describes what happens to log data when the Security Event Manager (formerly Log & Event Manager) appliance is not accessible on the network.

Security Event Manager

For all agent nodes (Windows, Linux, Unix, AIX, Macintosh systems) where an agent has been installed, the data is queued up within the agent folder while SEM is unreachable, and then sent to SEM over a secure TCP connection when it is back up. 

For syslog nodes (routers, switches, and firewalls, and possibly Unix or Linux devices without an agent), the data is sent over UDP on port 514 and will be lost if it is unable to reach SEM.

For SNMP data, SEM only uses a listening service, and trap traffic received from these devices uses port 161 or 162.
Review the following articles for further information about the communications between network nodes and SEM:

• SolarWinds SEM Port and Firewall Requirements
• What can the SEM Agent do when it is disconnected from the SEM Manager
• Understanding syslog in SEM
• Enable the SNMP Trap Listening service in SEM