Documentation forLog Analyzer
Analyzing logs is a key capability of SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) and is available in the Essentials edition. Log Analyzer (LA) is also available in a standalone module.

LA Getting Started Guide

Welcome to the SolarWinds Log Analyzer (LA) Getting Started Guide.

Ensure your long term success with SolarWinds LA by following the guidelines described in this guide. Depending on your workload, getting started with NCM should take you one week or less.

Prerequisites

  • Purchased or are evaluating NPM and LA.
  • Installed NPM and are adding LA to your SolarWinds Platform deployment.
  • Completed the NPM Getting Started Guide. There are some very important principles and skills that you learn in the NPM Getting Started Guide, so SolarWinds highly encourages you to work through that content.

Get started with LA

To get started with LA complete the following tasks.

Install LA

Use the SolarWinds SolarWinds Platform Installer to prepare the environment and install LA.

Add devices to SolarWinds Platform

You will need to add a node or device to SolarWinds Platform before you can enable log monitoring for the device. You can add a node, or multiple nodes for multiple devices, using one of the following methods.

Enable log monitoring for your devices

Depending on what type of data you collect with your devices, log monitoring can be automatically or manually enabled.

  • Syslog and trap messages — Log monitoring is automatically enabled when you add the device to LA.

    Devices sending SNMPv3 traps must be added as SNMPv3 nodes since credentials are required to decrypt messages.

  • Log files — Log monitoring is automatically enabled after you assign the node to the collection profile.
  • Windows Events — You must enable log monitoring manually.

Agents must be deployed to nodes that collect log files or Windows Events before you can enable log monitoring.

Configure devices to send messages

Once you have discovered devices and added them to LA for monitoring, you can configure your device to send messages to LA.

Existing customers: Follow the recommendations in the LA Installation Guide to ensure your system capabilities are correct and your production environment is sized correctly. Minimum system requirements used during evaluation are not sufficient for a production environment. Access your licensed software from the SolarWinds Customer Portal. If you need any implementation help, contact our Support Team.

LA replaces the existing legacy syslog and trap services. After installation of LA over the legacy syslog and trap services, the records remain in the database, but will not be used by LA. You can still access the records in the Syslog Viewer and Traps Viewer applications until they're removed by database maintenance after the retention period. All rules will remain available after the retention period. All new syslog and trap messages will be stored in the dedicated LA database.

Evaluators: If you are evaluating SolarWinds LA, download a free 30-day evaluation. The evaluation version of SolarWinds LA is a full version of the product, functional for 30 days. After installing LA, you can add nodes to the SolarWinds Platform and enjoy an unlimited number of SolarWinds Platform and LA nodes, including all paid features. When the evaluation period expires, both the SolarWinds Platform and LA licenses expire. After the evaluation period, you can convert your evaluation license to a production license. If you need assistance with your evaluation, contact sales@solarwinds.com.

Product terminology

SolarWinds Platform: The common platform used by SolarWinds Platform products, including NPM and LA. The platform provides the backbone for navigation, settings, and common features like alerts and reports. It also provides a consistent look-and-feel across products, giving you a “single pane of glass” for your SolarWinds Platform monitoring tools.

SolarWinds Platform Web Console: The web interface that you use to access LA and other products that run on the SolarWinds Platform products. This interface is used to view, configure, and manage all of your monitored objects.

SolarWinds Platform Application Server: A Windows server that runs the SolarWinds Platform Web Console and collects data from monitored objects.

SolarWinds Platform Database Server: A Windows SQL server that should be hosted on a dedicated server in a production environment, separately from the SolarWinds Platform Application Server. It stores SolarWinds Platform configuration data and all collected performance and syslog data.

Polling Engine: A Polling Engine controls polling job scheduling, data processing, and queries your monitored devices for performance metrics like CPU, memory, and up/down status. Additional Polling Engines can be licensed to provide additional scalability and capacity. By default, the SolarWinds Platform Server provides one Polling Engine (often referred to as the Main Polling Engine).