Documentation forLog Analyzer
Analyzing logs is a key capability of SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) and is available in the Essentials edition. Log Analyzer (LA) is also available in a standalone module.

Uninstall LA and restore legacy syslog and trap services

This procedure applies to LA versions 2020.2.6 and earlier. Do not apply these steps to versions 2022.1 and later.

If you have VMAN 8.4 or 8.5 installed, this action also uninstalls the VMAN VMware Events Add-on. In this case, reinstall the VMware Events Add-on.

  1. Log in to the Orion Platform Web Console as an administrator and access the Advanced Configuration Global settings. For example, http://localhost/Orion/Admin/AdvancedConfiguration/Global.aspx.

    The URL will open the Advanced Configuration Global settings tab.

  2. Scroll down to the SolarWinds.Orion.Core.Common.Settings.LegacyServicesSettings section and clear the check boxes.

    If the Orion Platform Web Console is not available use below SQL query to adjust settings directly in the SolarWinds Orion Platform database:

    UPDATE [Setting] SET [Value]='False'
    WHERE [Name] IN ('SolarWinds.Orion.Core.Common.Settings.LegacyServicesSettings.LegacySysLogServiceDisabled', 'SolarWinds.Orion.Core.Common.Settings.LegacyServicesSettings.LegacyTrapServiceDisabled')

  3. In the Orion Platform Service Manager, stop all services.

    If you are using the stand-alone Orion Platform Service Manager, click Shutdown Everything.

    Restarting the services is not necessary.

  4. Open Control Panel on your system and uninstall the following programs:
    • SolarWinds Log Analyzer (if present)
    • SolarWinds Orion Platform Log Viewer
    • SolarWinds Orion Platform SyslogTraps
  5. Delete the following files:
    • Navigate to C:\Program Files (x86)\SolarWinds\Orion\Packaging\Repository, and then delete the following:
      • Orion.SyslogTraps.2.*.opkg

      • Orion.Apollo.OLM*.opkg (may not be present on additional polling engines)

    • Navigate to C:\Program Files (x86)\SolarWinds\Orion\Packaging\Roots, open Orion.Installer.Packaging.roots in Notepad, and then delete the following line (requires Orion.Apollo.OLM):

      • <requires id="Orion.Apollo.OLM" version="[2.*,]" />

      • Click Save, and then close Notepad

    • Navigate to C:\Program Files (x86)\SolarWinds\Orion\Packaging and remove the whole folder Active.

    • Navigate to C:\ProgramData\SolarWinds\Installers, and then delete following:

      • Orion.Apollo.OLM*.opkg

      • OLM*.msi

      • ORIONLOGMANAGER*.msi

      • SYSLOGTRAPSLEGACY-2.*.msi

    • Navigate to C:\ProgramData\SolarWinds\Agent\Plugins, and then delete LogManager*.apkg.

  6. In the Orion Platform database, execute the following SQL script:
    UPDATE [WebView]
    SET [Url] = '/orion/netperfmon/syslog.aspx'
    WHERE [Name] = 'syslog'  
     
    UPDATE [WebView]
    SET [Url] = '/orion/netperfmon/traps.aspx'
    WHERE [Name] = 'traps'
     
    DELETE FROM [MenuItems] WHERE [Link] = '/ui/orionlog/logviewer/'
    DELETE FROM [MenuBars] WHERE [MenuName] = 'LOGS_TabMenu'
    DELETE FROM [ReportDefinitions] WHERE [Category] = 'Log Manager for Orion'		
    DELETE FROM [ReportDefinitions] WHERE [Category] = 'Log Analyzer'
  7. Delete the following registry keys:
    • SolarWindsLogPollingService from Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SolarWinds.Net\ConfigurationWizard\ServicesName
    • On all Orion Platform servers (including HA), make sure the following registry key is removed as well: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SolarWinds\Installer\InstalledFeatures = "OLM"

      The first bullet applies to the main polling engine, its HA backup, and any additional polling engine (free poller too) and its HA backup. The second bullet applies to any Orion Platform server, which means all from the first bullet plus additional websites.

    8. If you can find entry 479 under the following registry path, delete it also:
    • Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SolarWinds.Net\ConfigurationWizard\ConfiguredModules
  8. Download and install the legacy version of Syslog and Traps. Select an installer based on the version of your Orion Platform.

    9. During the installation process, the Configuration Wizard appears to guide you through the remaining steps. Steps 1-7 apply to the main Orion Platform server. Repeat steps 4, 5 and 8 for all additional polling engines and additional websites. The wizard restarts all services at this point.

  9. Uninstall the LogManager agent plug-in.
    • Download the Orion PlatformSDK (can be installed on a standalone machine).

      1. Start the SWQL studio, and then connect to the Orion Platform server as an administrator.

      2. Select Orion.AgentManagement.Agent.

      3. Right-click the UninstallPlugin verb, and then select Invoke.

      4. For each agent, enter the agentId, LogManager (and LogManager.LogFiles as of version 2020.2) as the pluginId, and then click Invoke.

        To find the agent ID in SWQL studio, right-click Orion.AgentManagement.Agent, and then select "Generate Select Statement".

    • If you need to force update the agents, do the following:
      1. On the Orion Platform Web Console menu bar, navigate to Settings > All Settings.
      2. In Node and Group Management, click Manage Agents.
      3. Select the agent, and then choose More Actions > Update.

After completing this procedure, the separate LA/Log Viewer SQL server database is no longer required.

Scripts are not supported under any SolarWinds support program or service. Scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The risk arising out of the use or performance of the scripts and documentation stays with you. In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation.