Submit a ticketCall us

AnnouncementsWeb Help Desk Integrations eCourse

Looking to reduce response times? Sign up for our eCourse to learn how integrating Web Help Desk with Dameware Remote Support, Network Configuration Manager, Network Performance Monitor, and Server & Application Monitor can improve communication efficiencies.

Register here.

Home > Success Center > Log & Event Manager (LEM) > Discovery is consuming Licenses

Discovery is consuming Licenses

Table of contents
Created by Craig O’ Neill, last modified by Cory Farr on Mar 03, 2017

Views: 830 Votes: 1 Revisions: 6


This article provides information when the auto-node discovery system is detecting that PC in your environment are sending logs directly to the LEM server. It indicates that new nodes are discovered and it automatically adds them to the active monitored nodes list.


LEM version 5.5 and later


Discovery happens if the IP address/hostname of the log data is different than the IP address/hostname of the agent. There's no way to turn it off since it's by design - some people have collectors, and we need to be sure that all of the original nodes are accounted for in the licensing count. If you however is not doing that, there's probably an issue of mismatch in the IP address the agent is reporting vs. the IP address the log is reporting.

If you find that there's something different about the machines, long host names or multiple IP addresses, this might be related to Symantec Endpoint logs. If you are forwarding, for example, Symantec Endpoint logs to LEM, then LEM sees a different source IP (Symantec) and machines (Symantec Clients).

Given a scenario where you have a syslog server that is aggregating logs form various devices then forwards these logs to LEMm auto node detection should pick up on this and assign a node to each of the devices forwarding logs to the syslog server.

In this scenario, some people choose to put an agent on a syslog server to aggregate that way rather than aggregate and forward syslog.


Last modified