4 Replies Latest reply on Feb 9, 2015 6:59 AM by curtisi

    LEM Licensing



      New to the LEM Licensing concepts .. thereby seeking some clarifications here ..


      Is my understanding coorect -

      1. One Network switch or a router consumes 1 node license

      2. One Security device like Firewall or VPN Concentrator consumes 1 node license

      3. One Domain Controller server consumes 1 node license

      4. One Application server with 1 interface also consumes 1 node license

      5. One Application server with 2 interfaces consumes 2 node licenses ??

      6. One Syslog Server consumes 1 node license ??


      Have referred to the foll link but still would like to make sure that I am not undersizing or oversizing the licenses.

      SolarWinds Knowledge Base :: How does the LEM Manager use node licenses?


      Kindly help clarify


        • Re: LEM Licensing

          The simplest way to explain the licensing is this: the LEM will identify a node and consume a license for each unique IP from which it receives logs.  The Agent is smart enough to work with the manager if an IP changes because of DHCP, but if the same agent sends traffic over multiple unique IPs, that consumes multiple licenses.


          If you can assign an affinity for the data to always use one interface, your server with two interfaces will only use one license.


          There is some discussion on how to try and alleviate the accidental duplication of nodes, so that may become a non-issue in the future.

          1 of 1 people found this helpful
            • Re: LEM Licensing

              What about the Syslog Server ? Kiwi Syslog Server to be precise.

              Will a Syslog server consume multiple Licenses of LEM ?

              Thanks for your answer earlier

                • Re: LEM Licensing

                  Just to walk you through a simple example


                  Scenario1: 10 switches send Syslog directly to LEM's inbuilt Syslog server = LEM will use 10 node licenses


                  Scenario2: 10 switches send Syslog to a Kiwi Syslog server. LEM Agent reads these logs from Kiwi Syslog Server, and sends the normalized events to LEM. This will consume 11 node licenses. 1 for the LEM Agent on the Kiwi Syslog Server, 10 for the switches.


                  So, the only difference between sending logs directly to LEM vs a detached Syslog server is 1 node license per Syslog server.

                  1 of 1 people found this helpful
                  • Re: LEM Licensing

                    There is a case where using the extra license for the syslog server is beneficial, though.


                    Syslog traffic is UDP, so if you're monitoring a remote data center and the link between that center and the LEM goes down, syslog traffic sent in that time is lost.  However, the LEM Agent caches data when it can't reach the LEM, so that data will wait until the link is restored and then back-fill the LEM database.


                    If you use a syslog server at the remote data center with the agent, then you'll get the syslog events cached and back-filled the same way.


                    Something to consider.