Submit a ticketCall us

AnnouncementsAre You “Flying Blind?”

When it comes to your complex IT infrastructure, you want to ensure you have a good grasp of what’s going on to avoid any fire drills that result from guesswork. Read our white paper to learn how proactively monitoring your IT environment can help your organization while giving you peace of mind.

Get your free white paper.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Random node displays in LEM

Random node displays in LEM

Updated February 13th, 2017


This article provides brief information and a resolution to the issue when a random node displays in the list of nodes in LEM. It displays as an IP address that does not belong to the nodes to be added or a set of disordered characters that displays as log files instead of as names. 


The following can cause the issue:

  • Random node displays on the list of nodes - A device is incorrectly sending syslogs to LEM. Syslog may need to be disabled or reconfigured on that device.
  • Change in the log format - An existing node had a change in the log format which caused LEM to "think" there was a new node sending information. 
  • Check for agent connectivity issues and duplicate discovery(Under appliance) connectors.


  1. It is okay to remove these types of nodes from the node list (MANAGE>Nodes) by clicking on the Gear Icon on the new node(s) and choosing delete. It is also possible to select multiple nodes in the node list for deletion, and then use the Gear Icon on the top right corner of the node list to remove the entire selected list. 

    NOTE: It is possible that these events may have been generated during testing or configuration actions and may not need further action beyond removing them; however, they may continue to be recreated if current log data is still coming in from the device and is being mismatched by the log syntax comparison in an incorrectly configured connector.
  2. IPAddress_Search.pngIf the node re-appears after removal, you can perform an nDepth search to locate a sample of the events logged by the random node. You can do this by going to: EXPLORE>nDepth, then create a query for any of the nodes being created.
  3. ToolAlias_Field_In_Event.pngUsing the nDepth results, particularly the ToolAlias field, determine which connector is generating the entry for these nodes and then locate which connector is creating the node entry.

  4. Open_Appliance_Connectors.pngIn the LEM WebConsole Review the connector to determine the events it is reading which are responsible for the invalid node entry. You can do this by going to: MANAGE>Appliances, then click on the Gear Icon on the left-hand side of the LEM listed in the appliance list and select Connectors.

  5. Connectors_Configured_CheckBox.pngOnce the Connectors pop-up window comes up on the screen, check the Configured checkbox on the left. This will allow you to see all configured connectors.

  6. Log_File_Path.pngLocate the connector from the ToolAlias and review the Log File path.

  7. Verify the correct connector is applied to the events. If not, remove the connector and apply the correct one. If the correct connector for the Manufacturer/Device is not available this may become a New Connector Request.
  8. If the connector is correct, one of the following issues may be the cause:
  • Log Syntax Changes: If the correct connector is in place for the device and is pointed at the correct log file path (local facility), it may need to be updated to account for any changes in the incoming event syntax. This can be due to device upgrades or changes in configurations on the device and would require that we capture an un-edited copy of the log syntax using the exportsyslog command from the CMC.
  • If this is a false positive coming from a connector in use, review the logging configuration on the conflicting device(s) and it may be necessary to modify the logging facility settings on either host so that the false positives can be avoided by sending the logging from the device to a different log file on the LEM (this applies only to syslog nodes). On occasion, connectors can pick up on the internal LEM logs if they are Linux/Unix type devices in which case we cannot change where the internal LEM logs are going and you would need to alter the logging facilty on the device to resolve the issue (contact SolarWinds Technical Support if changing the local facility is not possible). Local Facilities are listed using the checklogs command from the CMC.

If possible please collect the following items for review:

Screenshots of:

  1. The nodes being created
  2. Incoming events
  3. Connector configurations
  4. and device configurations (outlined in the steps above)


As well as a sample of the events using the exportsyslog command and an export of the nDepth Search results that contain information related to the random nodes.


Searching in nDepth can give out further details of which will either indicate, that a device is sending logs to LEM with this IP, or an existing node had a change in its logging format.




Last modified