Introduction to LA

Log Analyzer (LA) brings syslog, SNMP trap, Windows event, VMware event, and log file data from across your SolarWinds Platform environment into one searchable view, so you can find the log entry that explains an outage without connecting to each device in turn.

Because LA shares the node data you already monitor, every log entry arrives with the context of the device that sent it. Filter and tag entries as they stream in, search historical logs over any time range, and build log-processing rules that act on what they find by raising a SolarWinds Platform alert, forwarding entries to a SIEM, or dropping the noise before it reaches your database.

Download the PDF: LA Product Guide (formerly known as Administrator Guide)

For information about planning, installing, and getting started with LA, see the LA Getting Started Guide.

Log Analyzer and Log Viewer

Every SolarWinds Platform deployment includes the Log Viewer, which collects and displays syslog and trap messages. Log Analyzer is the licensed product that adds Windows event and log file collection, tagging, live mode, log forwarding, and longer retention on top of that foundation. Both share the same rules engine and the same viewer, so procedures that apply to one usually apply to the other.

To see exactly which features each one includes, see feature comparison. For an overview of what ships with the SolarWinds Platform, see View logs and events with the Log Viewer, along with installation scenarios and the licensing model. To try the full product, see Evaluate Log Analyzer. If you are moving from the legacy Syslog and Trap viewers, see Legacy rule migration.

Set up log collection

Before logs appear in the viewer, your devices need to send them and LA needs permission to receive and store them. Start by pointing devices at your SolarWinds Platform server, then decide which log types to collect from which nodes.

See Configure devices to send messages for the device-side setup, and Required privileges and permissions for the accounts involved. To encrypt syslog traffic in transit, see Configure secure syslog settings.

Windows event collection is configured separately. See Set up Windows event collection, then Monitor Windows security events and the Windows security event whitelist to control which security events are kept.

Collection profiles let you apply one collection policy to many nodes at once rather than configuring each node individually. See Create log collection profiles and Edit a collection profile. When a device sends messages but is not yet monitored, see Monitor logs from unknown devices.

View and investigate logs

The Log Viewer is where you spend most of your time. It streams entries as they arrive and lets you narrow them down by node, log type, severity, or your own tags until you are looking at the handful of entries that matter.

Start with Explore the Log Viewer for a tour of the interface. Then use Filter and analyze event logs to narrow the current view, and Filter and view event logs in live mode to watch entries arrive in real time while you troubleshoot.

Tags are labels you apply to entries so you can group and retrieve them later without rebuilding a filter each time. See Apply tags to event logs and Filter on log tags.

To investigate something that already happened, see Search and filter historical event logs, and Filter entry details to pivot from one entry's field values into everything else that shares them. To take results elsewhere, see Filter and export search results. To surface recent entries on a SolarWinds Platform dashboard, see Last XX log entries widget.

Automate with log-processing rules

Rules are how LA acts on logs without you watching them. A rule matches entries by condition such as source, severity, message content and then applies actions such as tagging, alerting, forwarding, or discarding. Rules are grouped into policies that evaluate in order, so the order you put them in decides which rule wins.

See Create custom log-processing rules to build your first rule, then Reorder custom rules to control evaluation order and Disable and enable log-processing rules to turn rules off without deleting them.

To reuse a rule you have already tuned, see Duplicate rules and Import and export rules. To pass log data to a script or executable, see Run external program variables.

Alert, forward, and reduce noise

Once rules are matching the entries you care about, connect them to the rest of your environment. Alerting brings log conditions into the same SolarWinds Platform alerts your team already responds to; forwarding hands entries to a SIEM or third-party system; dropping keeps low-value entries out of the database entirely.

See Integrate SolarWinds Platform alerts to trigger alerts from rules, and alert variables for syslogs and traps for the macros you can include in alert messages. The agent overload alert warns you when an agent is receiving more than it can process.

To send entries onward, see Log forwarding. To stop collecting entries that add nothing, see Drop unwanted event logs, the most direct way to control database growth.

Manage storage and review coverage

Retention settings decide how long each message type stays searchable, which is the main lever on how much database space LA uses. Reports tell you whether anything is sending logs that you are not actually monitoring or licensed for.

See Set storage and search retention periods and Review unlicensed and unmonitored log source reports.