Submit a ticketCall us

Training ClassThe Orion® Platform Instructor-led Classes

Provided by SolarWinds® Academy, these trainings will introduce users to the Orion Platform and its features, management, and navigation. These courses are suitable for users looking to discover new tips, tricks, and ways to adapt their Orion products to better suit their monitoring needs:
Deploying the Orion Platform
Configuring Orion views, maps, and accounts
Configuring Orion alerts and reports

Reserve your seat.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > LEM goes down daily and requires constant restarts

LEM goes down daily and requires constant restarts

Created by Jason Dee, last modified by Caroline Juszczak on Aug 23, 2018

Views: 1,233 Votes: 0 Revisions: 12


This article describes the issue when LEM functions normally for a period of time but becomes unstable and goes offline regularly requiring a reboot or a service restart to bring it back up. Symptoms may include:

  • Unable to log into the web console
  • All nodes show disconnected
  • No connectors are started
  • No events are coming into the Monitor tab
  • Very slow console performance


All versions of LEM


This issue may be caused by the following: 

  • Inadequate resource reservations
  • Too many events per day (EPD)
  • Too many rules firing
  • File Integrity Monitoring (FIM) monitoring is returning too many events
  • Duplicate or unnecessary connectors


  1. Determine how many events your LEM receives every day using an nDepth search and verify you have the proper amount of resource reservations to handle that load. See Allocating resources with reservations.
  2. Verify how many rules are firing on your LEM on a daily basis:
    1. Go to Explore > nDepth.
    2. Drag and drop the InternalRuleFired event to the search bar.
    3. Change the time frame to last day, and click Search.
    4. Your LEM should be firing no more than a few hundred events per day. If it's much more than that, you should determine which rules are firing really often and look at the rule to see how it can be fine tuned.
  3. If you've recently added a FIM connector to your agents and the FIM Monitor filters are set too broadly, you might be getting inundated with FIM events. Try disabling your FIM connectors to see if performance improves.
  4. Go to Manage > Appliances > left gear icon > Connectors. Select the Configured checkbox and look through the list of configured connectors for duplicate connectors, connectors for devices that you aren't actually logging, etc. See Configuring connectors.

If the issue is still unresolved, contact SolarWinds Support for further assistance.


Last modified