Submit a ticketCall us

Get a crash course on Network Monitoring delivered right to your inbox
This free 7-day email course provides a primer to the philosophy, theory, and fundamental concepts involved in IT monitoring. Lessons will explain not only how to perform various monitoring tasks, but why and when you should use them. Sign up now.

Home > Success Center > Log & Event Manager (LEM) > Discovery is consuming Licenses

Discovery is consuming Licenses

Table of contents
Created by Craig O’ Neill, last modified by Cory Farr on Mar 03, 2017

Views: 19 Votes: 1 Revisions: 6


This article provides information when the auto-node discovery system is detecting that PC in your environment are sending logs directly to the LEM server. It indicates that new nodes are discovered and it automatically adds them to the active monitored nodes list.


LEM version 5.5 and later


Discovery happens if the IP address/hostname of the log data is different than the IP address/hostname of the agent. There's no way to turn it off since it's by design - some people have collectors, and we need to be sure that all of the original nodes are accounted for in the licensing count. If you however is not doing that, there's probably an issue of mismatch in the IP address the agent is reporting vs. the IP address the log is reporting.

If you find that there's something different about the machines, long host names or multiple IP addresses, this might be related to Symantec Endpoint logs. If you are forwarding, for example, Symantec Endpoint logs to LEM, then LEM sees a different source IP (Symantec) and machines (Symantec Clients).

Given a scenario where you have a syslog server that is aggregating logs form various devices then forwards these logs to LEMm auto node detection should pick up on this and assign a node to each of the devices forwarding logs to the syslog server.

In this scenario, some people choose to put an agent on a syslog server to aggregate that way rather than aggregate and forward syslog.


Last modified
12:03, 3 Mar 2017