Cisco Catalyst switch

Can you run:

sho run | inc logg

On one of the switches that works and one that doesn't and compare them?

I ran that and they are both the same.  One thing I noticed, on the test messages I create in the log and event manager it the logs the event info as Unmatched CiscoIOS Data

I have found that when I try to add the switches in that working as nodes the log and event manager doesn't find them as a new node.  The ones that working I added just fine.

Are you perhaps running into a license limitation?  LEM is licensed by node count, much like many of the other SolarWinds products.  I believe it will just reject additional nodes once you reach the limit.

Another thought; are the switches (or your LEM, or other syslog server) that do not work on another subnet or behind an ACL/firewall that might prevent that communication?

I'm thinking it it because we were out of universal licenses, how can you change the license type to workstations?  All the servers running a Microsoft server OS using a universal license, can that be change to a workstation?

I'm not certain doing so would be ethical, if possible.  If I am understanding the question, that would be circumventing the enterprise licensing for a cheaper model and taking advantage of the product's licensing levels.

I doubt it's your intention to do that (to take advantage), so I think the best advice that I can give would be to contact your SolarWinds sales representative and have a conversation about consolidating the licensing levels you have to better fit your environment.  Who knows; you might even save a some money by reaching out to the right folks!

If I've misunderstood, please let me know.  I don't want to take this thread down the wrong path.

I was just wondering if a windows server had to be used as a universal license since those are for non workstations , so I viewed a universal license anything that doesn't run a windows OS, like switches, routers and those type of devices.

Right on--I hope you don't think I was making an assumption.  I just wanted to be on the same page.

I'm not certain on every variable LEM uses to determine the license needed, but I would make a guess that the host OS plays a large role in that.  In short, I'm afraid there likely is not a way to license a non-workstation as such.  Sorry.

I found a documents says universal includes windows servers.

Universal Node licenses are consumed by Windows Servers, Linux, Unix, MacOS and any syslog device.  Workstation licenses can only be used to cover Windows XP, Vista, 7, 8 and 10.  There isn't a way to convert the licenses in LEM, you'd need to contact your sales rep to add more licenses and/or go through your devices and delete old/deprecated nodes to reclaim and reuse universal licenses.