Quantcast
Channel: THWACK: Popular Discussions - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5911

Rules are not fired in LEM and nothing is shown in ndepth part.

$
0
0

Hi ,

I Deployed Solarwinds LEM , assigned an IP address to it and set date and time and deploy some agents.

in "Monitor" I see all real time logs but nothing is shown in "Ndepth" Part and no rules with the same correlation as ndepth conditions are fired.

 

 

For example

I see user logon events in "Monitor" section but in "Ndepth" section shows "No Results".

the condition set for Ndepth is:

UserLogon.DetectionIP=< one of my servers on which I deployed the LEM agent >

Time Range=Last 10 min, Last 30 min, Last hour, Last 2 hour, Last day...

 

 

I also checked out the followings:

The insertion time and detection time are the same,

The time and date and time zone is accurate on LEM manager and is the same as agents,

I saved and Enabled and Activated the rules,

set different Correlation Time for Rules,

restarted the manager...

But nothing happend, no success.

 

I appreciate any help in advance.


Viewing all articles
Browse latest Browse all 5911

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>