Submit a ticketCall us

AnnouncementsChange Is Inevitable

Get valuable help when it comes to tracking and monitoring changes. SolarWinds® Server Configuration Monitor (SCM) is designed to help you: detect, track, and receive alerts when changes occur, correlate system performance against configuration changes, compare server and application configuration against custom baselines, and verify application and system changes.

Learn more.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > LEM goes down daily and requires constant restarts

LEM goes down daily and requires constant restarts

Created by Jason Dee, last modified by Caroline Juszczak on Aug 23, 2018

Views: 1,185 Votes: 0 Revisions: 12


This article describes the issue when LEM functions normally for a period of time but becomes unstable and goes offline regularly requiring a reboot or a service restart to bring it back up. Symptoms may include:

  • Unable to log into the web console
  • All nodes show disconnected
  • No connectors are started
  • No events are coming into the Monitor tab
  • Very slow console performance


All versions of LEM


This issue may be caused by the following: 

  • Inadequate resource reservations
  • Too many events per day (EPD)
  • Too many rules firing
  • File Integrity Monitoring (FIM) monitoring is returning too many events
  • Duplicate or unnecessary connectors


  1. Determine how many events your LEM receives every day using an nDepth search and verify you have the proper amount of resource reservations to handle that load. See Allocating resources with reservations.
  2. Verify how many rules are firing on your LEM on a daily basis:
    1. Go to Explore > nDepth.
    2. Drag and drop the InternalRuleFired event to the search bar.
    3. Change the time frame to last day, and click Search.
    4. Your LEM should be firing no more than a few hundred events per day. If it's much more than that, you should determine which rules are firing really often and look at the rule to see how it can be fine tuned.
  3. If you've recently added a FIM connector to your agents and the FIM Monitor filters are set too broadly, you might be getting inundated with FIM events. Try disabling your FIM connectors to see if performance improves.
  4. Go to Manage > Appliances > left gear icon > Connectors. Select the Configured checkbox and look through the list of configured connectors for duplicate connectors, connectors for devices that you aren't actually logging, etc. See Configuring connectors.

If the issue is still unresolved, contact SolarWinds Support for further assistance.


Last modified