Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > What can the LEM Agent do when it is disconnected from the LEM Manager

What can the LEM Agent do when it is disconnected from the LEM Manager

Table of contents

Updated: 10/21/2016

Overview

As long as the SolarWinds Log and Event Manager Agent service is running, it will collect and normalize log data from its host's operating system and any third party security product it is configured to monitor. When the LEM Agent is connected to a LEM Manager, it sends the normalized log data to the LEM Manager in real time, resulting in a constant, secure, bandwidth-friendly flow of data.

Environment

  • LEM, all versions

Detail

When the LEM Agent is not connected to its LEM Manager, for instance when a laptop disconnects from the network, it queues the normalized log data until such time as it is reconnected to the network. The reconnected LEM Agent then sends the queued data to the LEM Manager to be displayed and stored.

 

The major difference is that most rules on the LEM Manager are set to not fire on alerts more than 5 minutes old, so queued alerts typically won't trigger them. Similarly, when a LEM Agent is not connected to its LEM Manager, its traffic will not trigger any rules in real time either, since the rules, along with their active responses, reside on the LEM Manager, not the LEM Agent.

 

The one exception is when the LEM Agent has the USB Defender Local Policy tool configured. This tool allows LEM Administrators to maintain a list of approved users and devices that is stored locally with USB Defender on the LEM Agent. Once in place, the USB Defender Local Policy tool will automatically detach any USB mass storage device that does not match one or the other criterion, regardless of whether the LEM Agent is connected to the LEM Manager.

 

 

Last modified

Tags

Classifications

Public