Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > Discovery is consuming Licenses

Discovery is consuming Licenses

Table of contents
Created by Craig O’ Neill, last modified by Cory Farr on Mar 03, 2017

Views: 27 Votes: 1 Revisions: 6

Overview

This article provides information when the auto-node discovery system is detecting that PC in your environment are sending logs directly to the LEM server. It indicates that new nodes are discovered and it automatically adds them to the active monitored nodes list.

Environment

LEM version 5.5 and later

Detail

Discovery happens if the IP address/hostname of the log data is different than the IP address/hostname of the agent. There's no way to turn it off since it's by design - some people have collectors, and we need to be sure that all of the original nodes are accounted for in the licensing count. If you however is not doing that, there's probably an issue of mismatch in the IP address the agent is reporting vs. the IP address the log is reporting.
 

If you find that there's something different about the machines, long host names or multiple IP addresses, this might be related to Symantec Endpoint logs. If you are forwarding, for example, Symantec Endpoint logs to LEM, then LEM sees a different source IP (Symantec) and machines (Symantec Clients).


Given a scenario where you have a syslog server that is aggregating logs form various devices then forwards these logs to LEMm auto node detection should pick up on this and assign a node to each of the devices forwarding logs to the syslog server.

In this scenario, some people choose to put an agent on a syslog server to aggregate that way rather than aggregate and forward syslog.

 

Last modified

Tags

Classifications

Public