Configure an agent in SEM

For non-network devices, you can install the SEM agent on workstations and servers to collect and normalize log data before it is sent to SEM. The SEM Agent also collects security data from each device (such as Windows event logs, database logs, and local antivirus logs) and transmits this data to SEM. The SEM Agent has a small footprint on the device and prevents log tampering during data collection and transmission.

The SEM Agent provides the following benefits:

  • Captures events in real-time
  • Encrypts and compresses the data for efficient and secure transmission to SEM
  • Buffers the events locally if you lose network connectivity to SEM

SEM provides access to the most frequently installed agents. See Additional SEM downloads for in the SolarWinds Customer Portal for a comprehensive list of agents.

The following example describes how to install a Windows agent on a workstation.

  1. Review the SEM agent pre-installation checklist.
  2. Log in to the SEM Console, and then click Manage > Nodes.
  3. Click Add Node.
  4. On the Add Node wizard, click the Agent Node option button.
  5. Follow the on-screen instructions to install an agent.
    1.  Place the agent installation file (local installer or remote installer) on the local hard drive.
    2.  Right-click the installation file, and then click Run as administrator.
    3.  In the Manager Host field, enter the SEM IP address.
  6. After you install the agent, click Go To Manage > Nodes on the Add Node wizard.
  7. Verify that the interface displays the node and the status is Connected.

    To verify that SEM is receiving agent data, Click the nodes tab in the SEM Events Console, and then select Agent and Connected under Refine Results.