Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > LEM Administrator's Guide > Managing events in LEM Monitor view

Managing events in LEM Monitor view

Updated: September 15, 2017

This topic describes how to work with events in Monitor view.

This topic provides help for Monitor view in the LEM console. For Monitor view page-level help, see Monitor view in the LEM console.

Events are messages created from Agent, Manager, and network device log entries. These log entries are processed (or normalized) to extract information and display the data in a common table format instead of the often convoluted format you see in the source data. The normalized events are sent from the Agent to the Manager for processing. At the Manager, the events are processed against your rules, sent to the database for archiving, and sent to the LEM console for monitoring.

When you click a filter in the Filters pane, inbound traffic is channeled through the filter and displayed in the events pane. You can pause the incoming event stream, sort and highlight the data, and respond to events with a corrective action. When completed, you can resume the incoming traffic that appears in the events grid.

Click the video File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1330-Troubleshoot_alerts_in_the_LEM_console/button_videocamera_18x12.png icon to learn how to use LEM to view all real-time and historical activity from a single IP address.

Review an event

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

    Click Monitor.

  2. In the Filters pane, select a filter.

  3. Locate an event in the event grid you want to explore.

  4. Click Pause to stop the event feed.

  5. Select the event in the grid.

  6. Click the Explore drop-down menu and select Event.

    The Event explorer displays all events associated with your selected event. Your selected event name displays in the History pane.

    Click Event Details to view additional event information.

To apply a filter to the Monitor event stream

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

    Click Monitor.

  2. Click Filters in the top left corner to open the Filters sidebar.

  3. Expand a filter category and select a default or custom filter from the Filters list.

    The events grid title bar displays the name of your selected filter, and the grid refreshed to display incoming events that match the conditions of your filter.

LEM saves event filters on the workstation running the LEM console. If you move to another workstation, you can export the filters to your new workstation and import them into the console.

To view the event details for a specific event in the event stream

  1. Apply a filter to the Monitor event stream (as described above).

  2. Select the event in the event stream and review the results in the Event Details pane.

Change the widget display for a selected filter

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

    Click Monitor.

  2. In the Filters pane, maximize a category and click the filter you want to modify.

  3. In the Widgets pane, click the drop-down menu and select the widget you want your filter to display.

To edit a widget chart presentation in Monitor view

Widgets displayed in Monitor view allow you to reconfigure the chart settings to suit your needs. These settings include the visualization type (line, bar, pie, or table), the color palette, and the X and Y axis labels.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

    Click Monitor.

  2. Click Monitor.

  3. In the Monitor dashboard, locate the widget you want to reconfigure.

  4. Click File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1220-Managing_events_in_LEM_Monitor_view/icon-widgetconfig2_17x17.png in the widget toolbar.

    The widget rotates the interface to display the presentation format settings.

  5. Reconfigure the widget settings as required.

    Your options are limited to the selected widget and the data it reports. For example, widgets that report in one dimension may be limited to a pie chart, while information in two dimensions can be reported in a bar or line chart.

  6. Click File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1220-Managing_events_in_LEM_Monitor_view/icon-widgetclose2_17x18.png to close.

    The widget rotates, displaying the information in your chosen format.

Sort the events grid

You can sort the events in the events grid by clicking the appropriate column header. For example, if you click the Event Name column header, the grid sorts the filtered events by event name in ascending order. If you click the column header again, the events are sorted in descending order.

  1. On the events grid toolbar, click Pause.

  2. Click the appropriate column header to sort your filtered events.

  3. When completed, click Resume to continue receiving filtered traffic.

Highlight events

In the Monitor view events grid, you can highlight events to call attention to them or mark them for future reference. This allows the events to stand out as you scroll through the contents of the grid. You can highlight multiple events at the same time. You can also choose the color you want for each set of events you are highlighting.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

    Click Monitor.

  2. In the Filters pane, select a filter from a filter group.

  3. On the events toolbar, click Pause to temporarily stop all incoming events.

    Pausing incoming events is not required, but it places all events in static mode for review.

  4. In the events grid, click the events you want to highlight.

    Press <Ctrl> to select two or more events.

  5. On the events grid toolbar, click File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1220-Managing_events_in_LEM_Monitor_view/highlightselectedrows_21x13.png to highlight a row with selected color or enter hexadecimal value.

    The events appear in your selected color.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1220-Managing_events_in_LEM_Monitor_view/highlightedrows.png

  6. Click Resume to resume the incoming web traffic.

Disable highlighted events

  1. On the events grid toolbar, click Pause to temporarily stop all incoming events.
  2. In the events grid, select the appropriate events to disable the highlight.

    Press <Ctrl> to select multiple events.

  3. On the events grid toolbar, click the File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1220-Managing_events_in_LEM_Monitor_view/highlightselectedrows_21x13.png drop-down menu and select No Color.

  4. Click Resume to resume all incoming events.

Copy event data to the clipboard

Copy event data for single or multiple events from the Monitor view events grid or Event Details pane to your clipboard. This allows you to paste the data into another application (such as Microsoft Excel for comparison or analysis), share the data with someone who does not have a console, or send to SolarWinds for technical support.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

    Click Monitor.

  2. In the Filters pane, select a filter from a filter group.

  3. In the events grid, select the event you want to copy.

    Press <Ctrl> to select two or more events.

  4. In the events grid, click and select Copy.

    The event data is now copied to your clipboard (as text).

Tag events as Read or Unread

You can mark events in event filter as unread and read. This process allows you to track examined and unexamined events.

The grid refreshes based on your selection.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

    Click Monitor.

  2. Click Monitor.

  3. In the Filters pane, select a filter from a filter group.

    The events grid displays your selected filter.

  4. In the events grid, select the events you want to mark as read or unread.

  5. Press <Ctrl> to select two or more events.

  6. In the events grid, click and select one of the following options:

    • Mark Unread identifies one or more selected events as unread in bold text. Any events captured by other filters appear as unread in those filters as well.

    • Mark Read identifies one or more selected events as read in non-bold text.

    • Mark All Unread identifies all events as read in bold text.

    • Mark All Read identifies all events as read in non-bold text.

Remove events

You can remove one or all events from a filter. This allows you to clean a filter of historical information that is no longer important.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

    Click Monitor.

  2. In the Filters pane, select a filter from a filter group.

  3. In the events grid, select the events you want to remove.

    Press <Ctrl> to select two or more events.

  4. In the events grid, click and select Remove to remove your events.

    Select Remove All to remove all events.

    The selected events are removed from the grid.

This topic provides page-level help for the
Last modified

Tags

Classifications

Public