This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Rules are not fired in LEM and nothing is shown in ndepth part.

mohadese over 6 years ago

Hi ,

I Deployed Solarwinds LEM , assigned an IP address to it and set date and time and deploy some agents.

in "Monitor" I see all real time logs but nothing is shown in "Ndepth" Part and no rules with the same correlation as ndepth conditions are fired.

For example

I see user logon events in "Monitor" section but in "Ndepth" section shows "No Results".

the condition set for Ndepth is:

UserLogon.DetectionIP=< one of my servers on which I deployed the LEM agent >

Time Range=Last 10 min, Last 30 min, Last hour, Last 2 hour, Last day...

I also checked out the followings:

The insertion time and detection time are the same,

The time and date and time zone is accurate on LEM manager and is the same as agents,

I saved and Enabled and Activated the rules,

set different Correlation Time for Rules,

restarted the manager...

But nothing happend, no success.

I appreciate any help in advance.

Top Replies

curtisi over 6 years ago +1

Do you also see nothing if you just run a blank search for the last 10 minutes?

0 curtisi over 6 years ago

Do you also see nothing if you just run a blank search for the last 10 minutes?
Cancel
Vote Up +1 Vote Down

Cancel
0 mohadese over 6 years ago in reply to curtisi

I see nothing at all
Cancel
Vote Up 0 Vote Down

Cancel
0 curtisi over 6 years ago in reply to mohadese

That implies a much bigger problem. If you go to Manage --> Appliance --> LIcense, what's shown there?
Cancel
Vote Up 0 Vote Down

Cancel
0 mohadese over 6 years ago in reply to curtisi

I install Solarwinds LEM in trial mode.
Cancel
Vote Up 0 Vote Down

Cancel
0 curtisi over 6 years ago in reply to mohadese

Based on that, it doesn't appear that you have any devices sending data to LEM. If there's nothing sending, then we can't show you any search results and there's nothing to fire rules off.
Have you deployed any agents or configured any devices to send syslog to the LEM yet?
Cancel
Vote Up 0 Vote Down

Cancel
0 m_roberts over 6 years ago

In addition - what do you see under Manage > Nodes?
I haven't seen an installation where events are showing in Monitor but not in nDepth. This would suggest an issue with node registration or nDepth database. May be necessary to open a case for this.
Cancel
Vote Up 0 Vote Down

Cancel
0 mohadese over 6 years ago in reply to curtisi

Yes
I mentioned in my question that I deployed some agents and I see log and events in "Monitor" section in LEM console.
the Solarwinds LEM services are Running on deployed agents and I see those agents under Manage > Nodes. The status of those agents are connected and green
Cancel
Vote Up 0 Vote Down

Cancel
0 mohadese over 6 years ago in reply to m_roberts

Under Manage > Nodes I see my deployed agents with connected status.
I checked the LEM services on deployed agents, thye are running.
Even I can see agents Log and events under "Monitor" section. for example when I login to one of my deployed agents, I can see the logon logs under Monitor part. I can see Who, When, from where logged in to that agent, but when I run a query on ndepth, nothing is shown.
Cancel
Vote Up 0 Vote Down

Cancel
0 curtisi over 6 years ago in reply to mohadese

That's interesting because the license for an eval allows for 2,147,483,647 devices (that's the number after the "LEM" in your screenshot.)
Currently, according to that screenshot, you have 2,147,483,647 available licenses (none have been claimed by Agents or Syslog).
2147483647 - 2147483647 = 0 devices used.
Is all this information from the same LEM deployment or do you have multiple appliances?
Cancel
Vote Up 0 Vote Down

Cancel
0 mohadese over 6 years ago in reply to curtisi

From the same LEM deloyment.
I have just one appliance.
I think the problem is about database.
how can I see the LEM database, how can I see what is stored in the tables?
Cancel
Vote Up 0 Vote Down

Cancel