Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > Understanding LEM Agent time stamps

Understanding LEM Agent time stamps

Table of contents
Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 46 Votes: 0 Revisions: 7

Overview

When looking at Node states in either the Manage > Nodes screen or the Node Health widget, it is possible that you see a Last Connected date in the past for some of your Agent Nodes.

Environment

All LEM versions

Detail

The important thing is that there are a number of “times” that describe the LEM Agent and the last time it did functioned. Double click a node, and you see this information. 

 

  • Last Event: This is the last time an event came from this node. In this example, that was four seconds ago.
  • Install Date: This is when the Agent was first installed/came on-line to communicate with the LEM appliance.
  • Last Connected: This is the last time the LEM Agent went through a complete handshake with the Log and Event Manager appliance. In the example, this is more than 4 seconds ago.


If you open the SPOP log on the Agent node (the default path in Windows is "C:\Windows\SysWOW64\ContegoSPOP\spoplog.txt”) and look through the lines, you should see lines like these:


(Sun Sep 27 12:01:08 MDT 2015) II:INFO [AgentVersionHeaderProvider] {main:1} SolarWinds Log and Event Agent (Release: 6.2.0[release] build: 6.2.0.992.565529)
(Sun Sep 27 12:01:08 MDT 2015) II:INFO [SpopModule] {main:1} Java version: 1.7.0_80 Java home: C:\Windows\SysWOW64\ContegoSPOP\jre1.7.0_80
(Sun Sep 27 12:01:09 MDT 2015) WW:WARNING [LEMSlf4jConfigurationManager] {main:1} Can't load logging prefs classpath*:/debug-default.conf
(Sun Sep 27 12:01:09 MDT 2015) II:INFO [SpopModule] {main:1} Event memory was set to: 1000
(Sun Sep 27 12:01:09 MDT 2015) II:INFO [SpopModule] {main:1} Events per queue was set to: 100000
(Sun Sep 27 12:01:09 MDT 2015) II:INFO [SpopModule] {SPOP:8} Starting TriGeo Agent (Release 6.2.0) build [release]
(Sun Sep 27 12:01:09 MDT 2015) II:INFO [SpopModule] {SPOP:8} build server version string: 6.2.0.992.565529
(Sun Sep 27 12:01:09 MDT 2015) II:INFO [InDepthConfigProps] {SPOP:8} nDepth enabled via default because InDepthEnable not present
(Sun Sep 27 12:01:09 MDT 2015) II:INFO [InDepthConfigProps] {SPOP:8} indepth.conf not found at C:\Windows\SysWOW64\ContegoSPOP\indepth.conf

(Sun Sep 27 12:01:09 MDT 2015) WW:WARNING [RawDataClient] {SPOP:8} Status Inactive
(Sun Sep 27 12:01:09 MDT 2015) II:INFO [UpdateClient] {SPOP:8} OS signature: Windows Server 2008 R2;6.1;x86
================ TRUNCATED FOR BREVITY ================
(Sun Sep 27 12:01:13 MDT 2015) II:INFO [ComModuleSpop] {ComModuleSpop:21} Opening installed connection to parent.
(Sun Sep 27 12:01:15 MDT 2015) II:INFO [NioComNetworkParent] {ComModuleSpop:21} Creating Nio Center for Client.
(Sun Sep 27 12:01:15 MDT 2015) II:INFO [NioCenterOnClient] {ComModuleSpop:21} Initializing Nio Center.
(Sun Sep 27 12:01:15 MDT 2015) II:INFO [NioComNetworkParent] {ComModuleSpop:21} Starting Nio Center for Client thread.
(Sun Sep 27 12:01:15 MDT 2015) II:INFO [NioSelectorOnClient] {NioComNetworkParent:22} Force flush after every nio write: false
(Sun Sep 27 12:01:15 MDT 2015) II:INFO [NioSelectorOnClient] {NioComNetworkParent:22} Send socket buffer size: 65536
(Sun Sep 27 12:01:15 MDT 2015) II:INFO [NioSelectorOnClient] {NioComNetworkParent:22} Receive socket buffer size: 8192
(Sun Sep 27 12:01:15 MDT 2015) II:INFO [NioCenterOnClient] {NioComNetworkParent:22} Nio Center successfully initialized.
(Sun Sep 27 12:01:15 MDT 2015) II:INFO [NioCenterOnClient] {NioComNetworkParent:22} Nio Center Connecting.
(Sun Sep 27 12:01:16 MDT 2015) II:INFO [NioSelectorOnClient] {NioComNetworkParent:22} Successful binding to host: 0.0.0.0/0.0.0.0:37893 , on port: 37893

(Sun Sep 27 12:01:19 MDT 2015) II:INFO [NioSelectorOnClient] {NioComNetworkParent:22} Beginning SSLHandshake.

(Sun Sep 27 12:01:21 MDT 2015) II:INFO [NioComNetworkParent] {ComModuleSpop:21} Nio initialization successful.

(Sun Sep 27 12:01:21 MDT 2015) II:INFO [NioSelectorOnClient] {ComModuleSpop:21} Retrieved hostname machine-hostname-netbios from the network socket on agent node local host

(Sun Sep 27 12:01:21 MDT 2015) II:INFO [NioSelectorOnClient] {ComModuleSpop:21} Retrieved IP address 192.168.10.127 from the network socket on agent node local host

(Sun Sep 27 12:01:23 MDT 2015) WW:WARNING [NioComNetworkParent] {ComModuleSpop:21} Manager connection complete.
(Sun Sep 27 12:01:23 MDT 2015) II:INFO [NioSelectorOnClient] {ComModuleSpop:21} Retrieved hostname machine-hostname-netbios from the network socket on agent node local host
(Sun Sep 27 12:01:23 MDT 2015) II:INFO [NioSelectorOnClient] {ComModuleSpop:21} Retrieved IP address 192.168.10.127 from the network socket on agent node local host
(Sun Sep 27 12:01:23 MDT 2015) WW:WARNING [NioComNetworkParent] {ComModuleSpop:21} Opened connection to manager at 192.168.10.15
(Sun Sep 27 12:01:24 MDT 2015) II:INFO [SpopModule] {SPOP:8} Initializing Spring context
(Sun Sep 27 12:01:24 MDT 2015) II:INFO [SpopModule] {Initialize Secret Center:11} Initializing the secret center
(Sun Sep 27 12:01:24 MDT 2015) II:INFO [SpopModule] {Initialize RCC Server:12} Initializing the Connector Message Center
(Sun Sep 27 12:01:24 MDT 2015) II:INFO [SpopModule] {Initialize RCC Server:12} Initializing the Connector API Command Center
(Sun Sep 27 12:01:24 MDT 2015) II:INFO [ApplicationContexLoader] {SPOP:8} Active profiles: [agent, strongEncryption]
(Sun Sep 27 12:01:24 MDT 2015) II:INFO [ApplicationContexLoader] {SPOP:8} Resource: file [C:\Windows\SysWOW64\ContegoSPOP\spop.conf]
(Sun Sep 27 12:01:24 MDT 2015) II:INFO [ApplicationContexLoader] {SPOP:8} Configurations: [class com.trigeo.core.AgentSpringConfiguration]
(Sun Sep 27 12:01:24 MDT 2015) II:INFO [CommInfoAgent] {ComModuleSpop:21} Dispatching parent connect signal
(Sun Sep 27 12:01:24 MDT 2015) WW:WARNING [LogManagementRegistryClient] {ComModuleSpop:21} parentConnected

 

If you look at the bolded text above, you will see that the time in the LEM GUI matches the time that the Nio initialization was successful and the SSL Handshake is completed. That was the last time the Agent “connected” even if the Agent has sent events since that time. This time is within seconds of the Agent confirming the parent (the LEM appliance) is connected correctly.


The Last Connected time is usually only updated if:

  • The Agent machine reboots.
  • The Agent service on the Agent machine is stopped and restarted.
  • The LEM manager is rebooted.
  • The LEM manager service is restarted.
Last modified

Tags

Classifications

Public