Submit a ticketCall us

Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.

 

Home > Success Center > Log & Event Manager (LEM) > LEM goes down daily and requires constant restarts

LEM goes down daily and requires constant restarts

Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 18 Votes: 0 Revisions: 11

Overview

This article describes the issue when LEM functions normally for a period of time but becomes unstable and goes offline regularly requiring a reboot or a service restart to bring it back up. Symptoms may include:

  • Unable to log into the web console
  • All nodes show disconnected
  • No connectors are started
  • No events are coming into the Monitor tab
  • Very slow console performance

Environment

All versions of LEM

Cause 

This issue may be caused by the following: 

  • Inadequate resource reservations
  • Too many events per day (EPD)
  • Too many rules firing
  • File Integrity Monitoring (FIM) monitoring is returning too many events
  • Duplicate or unnecessary connectors

Resolution

  1. Determine how many events your LEM receives every day using an nDepth search and verify you have the proper amount of resource reservations to handle that load. See Allocating resources with reservations.
  2. Verify how many rules are firing on your LEM on a daily basis:
    1. Go to Explore > nDepth.
    2. Drag and drop the InternalRuleFired event to the search bar.
    3. Change the time frame to last day, and click Search.
    4. Your LEM should be firing no more than a few hundred events per day. If it's much more than that, you should determine which rules are firing really often and look at the rule to see how it can be fine tuned.
  3. If you've recently added a FIM connector to your agents and the FIM Monitor filters are set too broadly, you might be getting inundated with FIM events. Try disabling your FIM connectors to see if performance improves.
  4. Go to Manage > Appliances > left gear icon > Connectors. Select the Configured checkbox and look through the list of configured connectors for duplicate connectors, connectors for devices that you aren't actually logging, etc. See Configuring connectors.

If the issue is still unresolved, contact SolarWinds Support for further assistance.

 

Last modified
20:13, 22 Jun 2016

Tags

Classifications

Public