Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > Log & Event Manager Installation Guide > LEM system requirements

LEM system requirements

Updated: August 30, 2017

Use the following tables to plan your Log & Event Manager deployment to suit your network environment.

In this topic:

 

Server sizing is impacted by:

  • Number of nodes and network traffic. Consider event throughput and performance degradation when planning the size of your deployment. As the number of nodes and network traffic increase, the size of your deployment will need to grow with it. For example, if you are running a small deployment and begin to notice performance degradation at 300 nodes, move to a medium deployment.
  • Storing original (raw) log messages in addition to normalized log messages. If you will be storing original log messages, increase the CPU and memory resource requirements by 50%. See your hypervisor documentation for more information.

Sizing criteria

Use the following table to determine if a small, medium, or large deployment is best suited to supporting your environment.

Sizing Criteria Small Medium Large
Number of nodes

Fewer than 500 nodes in the following combinations:

  • 5 – 10 security devices
  • 10 – 250 network devices, including workstations
  • 30–150 servers

Between 300 and 2,000 nodes in the following combinations:

  • 10 – 25 security devices
  • 200 – 1,000 network devices, including workstations
  • 50 – 500 servers

More than 1,000 nodes in the following combinations:

  • 25 – 50 security devices
  • 250 – 1,000 network devices, including workstations
  • 500 – 1,000 servers
Events received per day 5M – 35M events 30M – 100M events

200M – 400M events

Note: The most successful large deployments receive up to 250M events per day.

Rules fired per day Up to 500 Up to 1,000 Up to 5,000

LEM VM hardware requirements

See Allocate CPU and memory resources to the LEM VM in the LEM Administrator Guide for information about how to manage LEM system resources.

Hardware on the VM host Small Medium Large
CPU

2 – 4 core processors at 2.0 GHz

6 – 10 core processors at 2.0 GHz

10 – 16 core processors at 2.0 GHz

If you will be storing original log messages in addition to normalized log messages, increase the CPU and memory resource requirements by 50%.

Memory 8 GB RAM 16 GB – 48 GB RAM 48 GB – 256 GB RAM
Hard drive storage 250GB, 15k hard drives (RAID 1/mirrored settings) 500GB, 15K hard drives (RAID 1/mirrored settings)

1TB, 15k hard drives (RAID 1/mirrored settings)

  • Installing LEM in a SAN is preferred.
  • High-speed hard drives (such as SSD drives) are required for high-end deployments.
  • Large deployments may require 1 to 2TB of storage, which you can reserve on VMware ESX(i) 4/5+ and Microsoft Hyper-V 2008 R-2/2012.
Input/output operations per second (IOPS) 40 – 200 IOPS 200 – 400 IOPS 400 or more IOPS
NIC 1 GBE NIC 1 GBE NIC 1 GBE NIC

LEM software requirements

Software Requirements
Hypervisor (required on the VM host)

One of the following:

  • VMware vSphere ESX 4.0 or ESXi 4.0 and later
  • Microsoft Hyper-V Server 2016, 2012 R2, 2012, or 2008 R2
Web browser (required on a remote computer to run the web console)

One of the following:

  • Google® Chrome™ 17 and later

  • Microsoft Internet Explorer® 8 and later

    Note: The web console does not run on Internet Explorer 10 on Windows Server 2012.

  • Mozilla Firefox® 10 and later

Adobe Flash (browser plug-in required on a remote computer to run the web console) Adobe Flash Player 15
Optional software (required if you want to run the desktop console on a desktop computer)

Adobe Air Runtime

For more information, visit the "What is Adobe AIR?" page: http://www.adobe.com/products/air.html.   (© 2017 Adobe Systems Incorporated. Available at http://www.adobe.com. Obtained on October 24, 2017.)

LEM Agent hardware and software requirements

Hardware and Software Requirements
Operation System (OS)

The LEM Agent is compatible with the following operating systems:

  • IBM AIX

  • Linux

  • Mac OS X 10.7 or later

  • Oracle® Solaris

  • Windows (10, 8, 7, Vista)

  • Windows Server (2016, 2012, 2008)

The requirements specified below are minimum requirements. Depending on your deployment, you may need additional resources to support increased log-traffic volume and data retention.

CPU 450 MHz Pentium III or equivalent
Memory 512 MB RAM
Hard Drive Space 1 GB
Other requirements

Administrative access to the device hosting the LEM Agent

The LEM Agent for Mac OS X requires Java Runtime Environment (JRE) 1.5 or later.

LEM reports application hardware and software requirements

Hardware and Software Requirements
Operation System (OS)

The LEM reports application is Windows only. The following Windows versions are supported:

  • Windows 10, 8, and 7

  • Windows Server 2016, 2012, 2008, 2003
Memory

512 MB RAM minimum.

SolarWinds recommends using a computer with 1 GB of RAM or more for optimal reports performance.

Other requirements Install the LEM reports application on a system that runs overnight. This is important because the daily and weekly start time for these reports is 1:00 AM and 3:00 AM, respectively.

LEM port requirements

If your log sources are located behind firewalls, see  SolarWinds LEM Port and Firewall Information to open the necessary ports.

See the SolarWinds Port Requirements for SolarWinds Products Guide for a list of all ports required to communicate with SolarWinds products.

Last modified

Tags

Classifications

Public