This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Integrate Microsoft System Center Endpoint Protection with SolarWinds LEM

Does anyone have instruction on how to integrate Microsoft System Center Endpoint Protection with SolarWinds LEM?

We use Microsoft System Center Endpoint Protection for our anti-virus protection. System Center Configuration Manager (SCCM) collects the logs but only holds 30 days worth. We are interested in forwarding these logs from SCCM to LEM for correlation and to be stored longer. Any help would be appreciated!

Regards,

Shawn

  • Did some Googling, it appears that the logs are on the client in a number of locations based on this article: FEP Log Files

    And this technet thing: Endpoint Protection Scan Logs & Automated Tools For Malware Removal?

    I immediately see some problems that would need to be overcome:

    • Which of the log files are you interested in seeing in LEM?
    • Can you share any sample log files from your clients?
    • Is there anyway to control the rotation of the log files and the way they're named?
    • What information in those log files do you want to see normalized in LEM?

    Based on the FEP logs and some other resources, it looks like the file names use the following format:

    LogFileName_Date_Time.log

    where the following is true:

    • LogFileName is the name of the log file
    • Date is the day, month, and year the log was created, in the format DDMMYYY
    • Time is the hour, minute, and second the log file was created, in the format HHMMSS

    And I know this is the sort of thing that gives the connectors team fits and slows down development since code will need to be created to handle the file name changes, how to handle the EOF, how to find the next file, etc.  If there are options to control all this, that would make things a lot simpler.