Submit a ticketCall us

Webinar: Web Help Desk for HR, Facilities and Accounting Departments
This webinar will focus on use cases for HR, Facilities and Accounting.

Having a unified ticketing and asset management system for all the departments in your company can provide end-users with a seamless experience and make things easier for your IT team. Yet, with different business tasks and objectives, many departments don’t fully understand the capabilities of Web Help Desk and how the software can be customized for effective use in their departments.
Register Now.

Home > Success Center > Log & Event Manager (LEM) > LEM goes down daily and requires constant restarts

LEM goes down daily and requires constant restarts

Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 89 Votes: 0 Revisions: 11


This article describes the issue when LEM functions normally for a period of time but becomes unstable and goes offline regularly requiring a reboot or a service restart to bring it back up. Symptoms may include:

  • Unable to log into the web console
  • All nodes show disconnected
  • No connectors are started
  • No events are coming into the Monitor tab
  • Very slow console performance


All versions of LEM


This issue may be caused by the following: 

  • Inadequate resource reservations
  • Too many events per day (EPD)
  • Too many rules firing
  • File Integrity Monitoring (FIM) monitoring is returning too many events
  • Duplicate or unnecessary connectors


  1. Determine how many events your LEM receives every day using an nDepth search and verify you have the proper amount of resource reservations to handle that load. See Allocating resources with reservations.
  2. Verify how many rules are firing on your LEM on a daily basis:
    1. Go to Explore > nDepth.
    2. Drag and drop the InternalRuleFired event to the search bar.
    3. Change the time frame to last day, and click Search.
    4. Your LEM should be firing no more than a few hundred events per day. If it's much more than that, you should determine which rules are firing really often and look at the rule to see how it can be fine tuned.
  3. If you've recently added a FIM connector to your agents and the FIM Monitor filters are set too broadly, you might be getting inundated with FIM events. Try disabling your FIM connectors to see if performance improves.
  4. Go to Manage > Appliances > left gear icon > Connectors. Select the Configured checkbox and look through the list of configured connectors for duplicate connectors, connectors for devices that you aren't actually logging, etc. See Configuring connectors.

If the issue is still unresolved, contact SolarWinds Support for further assistance.


Last modified
20:13, 22 Jun 2016