1 of 1 people found this helpful
I don't think this is a simpleton question! I don't think it has a simple answer, either.
It's true that the LEM can do a lot of things that Kiwi can't. LEM's strengths include normalizing the log data, correlating the logs and the ability to respond to events. Kiwi doesn't have an active response component and doesn't do correlations.
However, Kiwi and LEM can work together. There's been a few threads where the topic is "distributed LEM." If you have a lot of nodes, or a complex network topology, you can use Kiwi as a route point: devices log to Kiwi, and Kiwi forwards to LEM. This can be a powerful way to cut traffic, since Kiwi can do some filtering and send only desirable data to the LEM.
So it's complicated, and whether LEM + Kiwi makes sense will depend on your network topology and business needs.