1 Reply Latest reply on Jun 24, 2014 7:36 AM by curtisi

    what happens to event logs if LEM Agents (windows) cannot connect to LEM Manager

    garkre6210

      can you point me to a KB article that describes how long LEM Agents can be out of contact with their LEM Manager .

      (For example, if i need to reboot the ESX server, what happens to the events while the virtual appliance is not available; or if there is a problem on a network segment between the windows agent and the LEM Manager)

        • Re: what happens to event logs if LEM Agents (windows) cannot connect to LEM Manager
          curtisi

          Okay, there's this article:

           

          SolarWinds Knowledge Base :: What can the LEM Agent do when it's disconnected from the LEM Manager?

           

          What it doesn't tell you is "How long?" and the reason for that is that there's some trickery involved in figuring that out.

           

          First, by default, the LEM agent will queue data until there is less than 512MB free on the disk it's installed on.  So, if you have a 30GB hard-drive and 22GB are filled with Windows and programs, the agent will log about 7.5GB of data.  Then it starts rotating: it'll drop the oldest data to make room for new data. (The 512MB thing is configurable, and I always hear rumors we're going to change that default someday since newer systems sorta freak out with less than 1GB free, but as of Agent 6.0 this is still the case.)

           

          As an aside, if you do want to change this setting, do this:

           

          1. Stop the LEM Agent on the machine
          2. Open the %SYSTEM%\SysWOW64\ContegoSPOP\spop.conf file
          3. Add this line: QueueMinDiskFree=2048mb
          4. Restart the Agent Service

           

          That'll set the agent to stop queuing when there's 2GB free on the disk instead of 512MB.  Pick your value as you see fit.

           

          Second, that means that "How long?" is a function of your audit policy, the average size of the events on the system in question, the frequency of those events and the size of the disk.

          1 of 1 people found this helpful