Each of the products in the SolarWinds portfolio of products brings unique capabilities to the table to make I.T. management in your organization a much less painful process.

  • Server & Application Monitor (SAM) provides the ability to monitor servers and the applications running on them, and display status and generate alerts based on that status.
  • Log & Event Manager (LEM) provides the ability to collect log events from servers and network devices, and correlate those events.

Combining these two products in a cooperative effort can have exponential impacts on reducing the effort involved in managing I.T. those improvements. Let's look at two examples of scenarios where these products can enhance each other.

 

SQL Server performance loss

In our first example, consider the scenario where you have configured SAM to monitor an instance of SQL Server. SAM tracks a number of state and performance values on a SQL Server instance. One of the performance values that can be tracked is the amount of time consumed in running queries. If the queries exceed the defined performance threshold, SAM generates an alert that the condition exists. This information, however, requires further action. By itself it might require involvement of additional people, other tools, and will likely take some time to track down.

 

Adding LEM into the mix allows us to leverage the ability to correlate that performance metric with actual events that have occurred in that SQL database, SQL instance, and the server hosting the database engine. In addition to displaying the alert on the SAM console, we configure SAM to send that alert direct to LEM. LEM receives the alert, and through LEM's event log analyzer and the use of correlation rules, it can help to identify specific events that correlate to the performance degradation. In this example we discover that a configuration change made to the database by a DBA has resulted in the observed performance changes reported by SAM.

 

Exchange server farm reliability

In another example, consider the volume of log messages that are generated by an Exchange server farm. These log messages involve logons, logoffs, mail receipt, mail sends, distribution list expansions, and a whole host of other activities. The amount of events generated by a busy Exchange farm is really extensive. LEM allows us to use these correlation rules to identify issues on a more macro-scale than individual events. In our example the LEM correlation rule on a collection of Exchange events identifies a potential reliability issue with the Exchange server farm. LEM generates an automated alert to SAM, which results in a single Exchange monitor alert displayed on the SAM NOC view, and a technician can be dispatched to begin the investigation before the actual outage occurs.

 

Cooperative benefits

In both of these examples, SAM and LEM provide complimentary features that play to their own strengths. SAM has a great reporting dashboard that can focus on high-level status information, and LEM has a powerful correlation rules engine that allows for the automated interpretation of thousands of discrete events that represent trends in the state of an application or system.

SAM-LEM Cooperation.png

Both products are available for download today [SAM][LEM] with a 30-day evaluation. If you’re already using one of these great products, explore the benefits of enhancing your environment with the other.