Submit a ticketCall us

AnnouncementsChange Is Inevitable

Get valuable help when it comes to tracking and monitoring changes. SolarWinds® Server Configuration Monitor (SCM) is designed to help you: detect, track, and receive alerts when changes occur, correlate system performance against configuration changes, compare server and application configuration against custom baselines, and verify application and system changes.

Learn more.

Home > Success Center > Log & Event Manager (LEM) > Log & Event Manager (LEM) Documentation > LEM Administrator Guide > Run a LEM report on-demand or schedule a LEM report to run later

Run a LEM report on-demand or schedule a LEM report to run later

Updated: September 15, 2017

This topic describes how to run a LEM report on-demand, as well as schedule reports to run automatically. This topic also documents how to run the default LEM Batch Reports using Windows Task Scheduler.

Run an on-demand report in the LEM reports application

  1. Open the LEM reports application. See Open the LEM reports application for steps.

  2. On the Settings tab, click the Data Source drop-down menu and select a LEM Manager instance (the IP address or hostname of your LEM VM).


  3. (Optional) Click the Category drop-down menu and select a report category filter—for example, Audit.


  4. Select a report title and click Run in the toolbar.


  5. Select your start and end date and time parameters, and then click OK.


    The report displays in the View tab.

    This process may take several minutes to complete.


  6. Click Print in the toolbar to send the report to a local or network printer.

    Click Export to export the report to the appropriate format (such as a PDF or a Microsoft Word document).

Create a scheduled report in the LEM reports application

The following list provide an overview of the report scheduling process. Each step is described in greater detail in the subsections that follow.

  1. Open the LEM reports application. See Open the LEM reports application for steps.

  2. Select the report that you want to schedule, and then click Schedule.

  3. Name the scheduled task to distinguish it from other similar tasks.

  4. Set the schedule parameters.

    This states when the scheduled report runs.

  5. Apply any advanced scheduling options.

  6. Define when the system can and cannot run the task.

  7. Apply the scheduled report to the data source (Manager) for which you want a report. Then define the scope, which is the period you want to the report to cover.

    When the system runs the report, it retrieves any pertinent events that occurred within the period defined by the scope.

  8. Select any export options for the report.

    This allows you to export to the folder of your choice, and in a format that is easy to read and print. If you do not export the report, it will automatically print to your default printer.

Repeat this process for each report you want to schedule.

You can create more than one schedule for the same report. This allows you to run the same report on different LEM Managers or run the same report in different intervals (such as daily, weekly, or monthly), each with a different scope.

Step 1: Selecting the report you want to schedule

In this step, you will select the report you want to schedule, and then open the Report Scheduler Tasks window.

  1. Open the LEM reports application. See Open the LEM reports application for steps.

  2. In the Settings tab, click the Category drop-down menu and select a report category

    The report list displays all saved reports in the category.

  3. In the Report Title column, locate the report you want to schedule.

  4. Right-click the report and select Schedule Report.

    The Report Scheduler Tasks window appears.


    The Event Summary box only displays the tasks that apply to your selected report.

  5. Add, edit, and delete your scheduled report tasks.

Step 2: Add a new scheduled report task

Name and configure the new scheduled task associated with this report.

  1. Click Add in the Reports Scheduler Tasks window.

  2. Enter a name for the report, and then click OK.


    The task scheduler form displays.


  3. Verify that the path in the Run field is correct. Click Browse and select the correct path, if required.

  4. Verify that the user name in the Run as field is correct.

    To change the user path, use the following format:


  5. Click Set password to set up a password for the current user to run the report.

  6. Select the Enabled check box to run the scheduled task using the schedule you select in the Schedule tab.

    Clear the check box to disable the schedule.

  7. Click Apply to save your changes.

  8. Complete the Task tab as described in the table.

  9. Click Apply to save your changes.

Step 3: Schedule the report

Create the report schedule. The settings on the Schedule tab tell the system when to run the report.

You can create multiple schedules for each report that is within the same scope. For example, you can run an event summary report for the current week and display the running total for the week at each hour. When completed, you can set the report to Week: Current and have multiple schedules that run on an hourly schedule and on a twice-daily schedule.

  1. Click the Schedule tab.

    For new tasks, the tab states that the task is not scheduled.

  2. Click New to create a new report schedule.


  3. Complete the Schedule tab selections.

  4. Click Apply to save your changes.

    The new report schedule displays in the list box near the top of the tab.

Step 4: Select the advanced scheduling options

If you clicked Advanced in the Schedule tab, the Advanced Schedule Options dialog box displays. You can schedule start and end dates for the report, or set a task to repeat for a set period of time.


  1. Click Advanced in the Schedule tab.

  2. Select the start and end dates.

  3. Select the Repeat task check box if you want the system to stop running the repeated tasks.

  4. In the Until section, select the time or how long you want the task to run.

    By limiting the task run time, you can prevent the task from running continuously if a problem should occur.

  5. Select If the task is still running, stop it at this time to stop the system from running a report when the Time or Duration setting occurs. Clear this check box to have the system finish running a report that overlaps the Time or Duration setting.

    The following illustration displays the valid and invalid date formats for reports.


    In this example, the configured report runs every four hours, starting on Monday, August 18, and running through Sunday, August 30. Each time the task runs, the system will stop it if it continues to run for more than one hour.

  6. Click OK to save your changes and exit the form.

    You return to the task scheduler form.

Step 5: Stating when the system can or cannot run the task

Use the Settings tab to select when the system can and cannot run the task.

  1. Click the Settings tab.

  2. Complete the selections as required.


  3. Click Apply to save your changes.

  4. Click OK to close the task scheduler form and return to the Report Scheduler Tasks window.

Step 6: Assign the data source and scope

Assign the task to a particular data source (or Manager) and define the task scope (the period you want the report to cover). When the system runs the report, it retrieves any relevant events that occurred within the period defined by the scope.

  1. Select the report schedule you want to assign.


  2. Click Load to View or Edit.

    The Report Execution Settings For Selected Task section is enabled.

  3. Use this section to configure the report execution settings for the task (report schedule) you selected above.

  4. Use the Select the report data source list to select the Manager or to which you want to assign this task.

    You can only assign a task to a single Manager. If you need to assign a similar or identical task to a second Manager, create a new task.

Assign the task scope

In the Report Scope box, set up the task scope for this data source. The scope is the event period (or time frame) for the events you want the report to cover.


  1. Click the Date Range drop-down menu and select the date range you want the report to cover for this task and data source.

    In this example, the date range is Day: Today. The report will cover the period from 12:00:00 AM to 11:59:59 PM of the current date.

    If you select Week: Previous, the scheduled report will contain information from the last full week—from 12:00:00 AM the last Monday to 11:59:59 PM the last Sunday. For example, if today is Wednesday the 11th, the task runs from 12:00:00 AM on the 2nd to 11:59:59 PM on the 8th.

    Select one of the following date ranges:

    • Day: Today: Run for the specified time frame on the current (today’s) date.
    • Day: Yesterday: Run for the specified time frame on the previous (yesterday’s) date.
    • Week: Current: Run from one week ago to the current time.
    • Week: Previous: Run from 12:00:00 AM last Monday to at most 11:59:59 Sunday. This report will capture the last full week of data.
    • Month: Current: Run from one month ago to the current time.
    • Month: Previous: Run from 12:00:00 AM on the first of the month until 11:59:59 PM on the last day of the month. This will report will capture the last full month of data.
    • User Defined: Run another report scope. Use this option to schedule reports for arbitrary periods or periods that are outside of the conventional scope of a day, week, or month.
  2. Enter or select a start time and end time for reporting events that occurred on this Manager. The report will only show those events that occurred on the Manager within this period.

    If you select a week or month scope, you cannot edit the Start and End date and time fields.

  3. To configure the report so it automatically exports to a file, go to the next step. Otherwise, click Save.

    The Count Settings area only applies to count-based reports, such as “Top 20” reports.

  4. In the Number of Items box, type or select the number of items you want the report to track.

Step 7: Export a scheduled report

You can enable the report utility to automatically export a scheduled report in PDF format to a specific folder. Otherwise, the system will send the report to your default printer.

  1. Open the Report Scheduler Tasks window.

  2. Select the scheduled report task you want to export in the Task Description box.

  3. Select the Export check box in the Report Settings tab to name and export this report when the task scheduler runs this report.


  4. Click the Format drop-down menu and select a file format to export the report.

  5. Click the folder icon, locate the folder where you want to save the report, and a unique file name for the report.

    If the report has multiple schedules, give each scheduled report a different name. Otherwise, the exported file names files will overwrite each other or increment according to the If File Exists setting.

  6. In the If File Exists list, choose one of the following options:


    • Select Increment to store the new report along with any previous versions of the report in the folder. The reports application increments each report by appending the report file name with an underscore and a digit. For example, [FileName]_1.pdf.
    • Select Overwrite to have each new version of the report overwrite the previous version of the report in the folder.
  7. Click Save.

  8. Click Close to close the Report Scheduler Tasks window and return to the Reports window.

  9. Repeat Step 2: Adding a new scheduled report task through Step 7: Export a scheduled report for each report you want to schedule and assign to a particular data source.

Remove a report from the report scheduler

  1. Open the LEM reports application. See Open the LEM reports application for steps.

  2. Click the Settings tab.

  3. Click the Category drop-down menu and select Standard Reports or Custom Reports.

    The grid displays all reports in your selected category.

  4. In the Report Title column, click the name of the scheduled report for which you want to delete the task schedule.

  5. Click Schedule.

  6. In the Report Scheduler Tasks window, select the scheduled report in the Task Description list that includes the schedule you want to delete.

  7. Click Modify.

    The task schedule form displays.

  8. In the Task Schedule window, click the Schedule tab and select the Show Multiple Schedules check box.

  9. In the schedule list box, select the schedule you want to delete, and then click Delete.

  10. Click Close to close the Report Scheduler Tasks form.

Configure Windows Task Scheduler to run the default LEM Batch Reports

The LEM reports application includes a default batch set of .ini files used to schedule reports. These files contain the configurations necessary to schedule several best-practice reports on either a daily or weekly basis, depending on the scope.

Prepare the INI file

Modify the default .ini files in the LEM reports installation directory to specify the hostname of the LEM Manager or LEM database in your environment, and the export destination for your scheduled reports.

To modify the default INI files:

  1. Navigate to the LEM Reports installation directory and open the SchedINI folder:
    • On 32-bit computers: C:\Program Files\SolarWinds Log and Event Manager Reports
    • On 64-bit computers: C:\Program Files (x86)\SolarWinds Log and Event Manager Reports
  2. Open each of the BRPT*.ini files and make the following changes in a text editor:
    • Replace the default value next to Manager1 with the hostname of the LEM Manager or database appliance in your environment. Use the hostname of your LEM database appliance if you have a dedicated appliance to store your normalized LEM alert data.
    • Modify the ExportDest file path if you want to customize the location to which LEM Reports saves the exported reports. The default file path is %ProgramFiles%\SolarWinds Log and Event Manager Reports\Export.
  3. Save your changes and close the files.

Schedule the Reports to Run using Windows Task Scheduler

Schedule your batch reports to run using Windows Task Scheduler. Complete the following procedure twice: once for the daily reports and once for the weekly reports.

To schedule reports using Windows Task Scheduler:

  1. Create a new scheduled task by opening Control Panel > Administrative Tools > Task Scheduler.

  2. Select Task Scheduler Library.

  3. Click Create Basic Task in the Actions pane.

  4. Enter a name for your task that reflects the frequency of the scheduled task. For example, enter LEM Reports - Weekly for the weekly task, and then click Next.

  5. Select Daily or Weekly, depending on what batch of reports you are scheduling, and then click Next.

  6. Set the start time and frequency for your scheduled reports, and then click Next.


    • For the daily task: 1 AM, Recur every 1 Day
    • For the weekly task: 3 AM, Recur every 1 week, Monday
  7. Select Start a program, and then click Next.

  8. For the Program/script field, click Browse to browse for SWLEMReports.exe. See Step 1 in Prepare the INI file for the default installation paths.

  9. In the Add arguments (optional) field, enter the following, according to the task being created:


    • Use the %ProgramFiles(x86)% environment variable on 64-bit computers.
    • The /l at the beginning of the additional argument is optional. This generates a log file called SWLEMReports.log when Task Scheduler runs your task. The file is saved in %ProgramFiles%\SolarWinds Log and Event Manager Reports.
  10. For the daily task: /l "%ProgramFiles%\SchedINI\BATCHDay.ini"

  11. For the weekly task: /l "%ProgramFiles%\SchedINI\BATCHWeek.ini"

  12. Click Next.

  13. Verify the task details on the Summary dialog, select Open the Properties dialog for this task when I click Finish, and then click Finish.

  14. Click Change User or Group to change the user account task scheduler should use to complete the task.

    • Provide a user with administrator level permissions.
    • If you specified a network location in Step 2 in Prepare the INI file , provide a user with write permissions to that folder.
    • Use a service account to avoid having to maintain the task according to your password change policy.
  15. On the Properties window, select Run whether user is logged on or not.

  16. Select Run with highest privileges.

  17. Select the appropriate operating systems in the Configure menu, and then click OK to save your changes and exit the Properties window.

  18. Enter the Windows password for the user specified for this task, and then click OK.

Default Report Schedules

Once configured, the scheduled tasks run and export the following reports:

Daily Reports

  • EventSummary.pdf
  • SubscriptionsByUser.pdf
  • Incidents.pdf
  • NetworkTrafficAudit.rpt

Weekly Reports

  • MaliciousCode.rpt
  • NetSuspicious.rpt
  • NetAttackAccess.rpt
  • NetAttackDenial.rpt
  • Authentication.rpt
  • FileAudit.rpt
  • MachineAudit.rpt
  • ResourceConfiguration.rpt
  • You can open reports with the .rpt extension in the LEM reports application for filtering and exporting. If you have a program like Crystal Reports associated with this file format, you can access these reports with the LEM reports application by opening LEM Reports first and then clicking Open on the Settings tab.
  • If you create a scheduled report, you can remove the task from Windows task scheduler, and the .ini file will still be under the SchedINI directory. You can change the name of the RPTxxxxx-x.ini to BRPTxxxxx-x.ini, and add the file to the BatchDay.INI or the BatchWeek.INI.

Edit a scheduled report in the Task Scheduler

When you create custom and scheduled reports, SolarWinds recommends that you document your procedures for disaster recovery.

The scheduled Report INI files are located in: Program Files\SolarWinds Log and Event Manager Reports\SchedINI. These report INI files are generated automatically when you schedule a report in the LEM console. If you need to edit an INI file or change a report format, add the corresponding report format after the equal sign to the line containing "ExportFormat= ".

The following table identifies the number assigned to each possible format for a LEM report.

Number Report Format
1 Excel: MS Excel 97-2000, with headings format
2 Exceldata: MS Excel 97-2000, data only format
3 HTML32: HTML version 3.2 format
4 HTML40: HTML version 4.0 format
5 PDF: Adobe Portable Document format
6 RTF: Rich Text Format
7 CSV: Separated Values Text format
8 TAB: Tab Separated text format
9 Text: Text based report format
10 Word: MS Word Document format
11 XML: XML Document format
12 RPT: Crystal RPT w/ Data format

Below is an example of a LEM scheduled report INI file:

Filename=C:\Program Files\SolarWinds Log and Event Manager Reports\Reports\RPT2009-33-1.rpt
RptStartTime=12:00:00 AM
RptStopTime=11:59:59 PM
ExportDest=C:\Program Files\SolarWinds Log and Event Manager Reports\Export
Last modified