Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Unable to run LEM Reports

patrick.hayes1

Hoping someone might be able to point me in the right direction here.

Background:

LEM 5.4 > Upgraded to 5.6

Stood up new server on 5.7

Migrated clients to new server

Transferred license to new server

Trying to run reports against old server (5.6) to export and archive for PCI

Had problems connecting to old server, worked with support and got Reports to connect to the correct server. Now when trying to run reports I receive the following error:

5-20-2014 1-53-58 PM.jpg

Find more posts tagged with

siem

security_information_and_event_management

hipaa

Accepted answers

curtisi

There's a limit of 10 million events and 2GB on any report, so if the resultant report will get more than either of those, it'll fail. A whole year on a LEM will probably break at least one of those limits.

All comments

curtisi

Couple things to try:

First, open the Reports shortcut. At the end of the target line, add "/L" so it looks like this:

"C:\Program Files (x86)\SolarWinds Log and Event Manager Reports\SWLEMReports.exe" /L

Now when you run reports, you'll get a log file in the Reports install directory called SWLEMReports.log. Can you paste that output in this thread?

Second, if you open a command prompt and run this command:

telnet {The LEM IP or Hostname} 9001

What is the response? You'll need to have the Telnet client Windows feature enabled for this command to work at all.

patrick.hayes1

2014-05-21 15:02:25.732 threadid=9388 Not Found: C:\Users\xxxx\AppData\Roaming\lem.console*

2014-05-21 15:02:25.732 threadid=9388 Found: C:\Users\xxxx\AppData\Roaming\sim.console\Local Store\Managers.txt

2014-05-21 15:02:32.611 threadid=9388 ******************** SWLEMReports.exe : Version 5.6.0.23 ******************

2014-05-21 15:02:32.611 threadid=9388 --------------------

2014-05-21 15:02:32.611 threadid=9388 Opening report file C:\Program Files (x86)\SolarWinds Log and Event Manager Reports\Reports\RPT2003-01-01.rpt

2014-05-21 15:02:32.876 threadid=9388 Report Title: Event Summary - Top Level Statistics

2014-05-21 15:02:32.876 threadid=9388 Selected manager: xx.xx.xx.xx

2014-05-21 15:02:32.876 threadid=9388 Assigning ReportDataObj

2014-05-21 15:02:32.876 threadid=9388 Query Handling: parse

2014-05-21 15:02:32.876 threadid=9388 Rebuild for HSQL connections

2014-05-21 15:02:32.986 threadid=9388 DBType = HSQL

2014-05-21 15:02:32.986 threadid=9388 HostName = xx.xx.xx.xx ; Port = 9001 ; Protocol = HyperSQL

2014-05-21 15:02:32.986 threadid=9388 Database = alertdb ; User = contego

2014-05-21 15:02:32.986 threadid=9388 CRUtils.SetParamValueByName succeeded

2014-05-21 15:02:54.700 threadid=9388 Successfully set report parameters

2014-05-21 15:02:54.700 threadid=9388 Report Start Date/Time: 3/1/2014 3:02:33 PM

2014-05-21 15:02:54.700 threadid=9388 Report End Date/Time: 5/21/2014 3:02:33 PM

2014-05-21 15:02:54.700 threadid=9388 JDBC to HSQL data access

2014-05-21 15:02:54.700 threadid=9388 Retrieving raw query text...

2014-05-21 15:02:57.040 threadid=9388 Raw report query:

select

TRUNC(es.detectiondatetime, 'HH') as "alert_time"

, cast(alertid as varchar(32)) as "alert_name"

, cast(es.alertmask as varchar(20)) as "alert_code"

, sum(es.alertcount) as "alert_count"

from eventsummary es

where

es.detectiondatetime >= {?Start Date/Time}

and es.detectiondatetime < {?End Date/Time}

and alertmask >= 1e+18

and alertmask < 326*1e+16

group by TRUNC(es.detectiondatetime, 'HH'), es.alertmask, es.alertid

patrick.hayes1

HSQLDB JDBC Network Listener.

Use JDBC driver with Network Compatibility Version2

.1.0.0 and a JDBC URL like jdbc:hsqldb:hsql://hostname...

Connection to host lost.

patrick.hayes1

Looks like the issue may be too much data for the time frame I am trying to run. I was trying to pull the past year. If I narrow it down a bit the reports run.

curtisi

patrick.hayes1

This was it. Thank you so much for the help.