This PDF Is No Longer Being Maintained. Search The Solarwinds For More Information
This PDF Is No Longer Being Maintained. Search The Solarwinds For More Information
This PDF Is No Longer Being Maintained. Search The Solarwinds For More Information
i
Contents
Table of Contents
Chapter 1: Introduction 1
Chapter 2: Installing LEM 2
Basic deployment procedures 2
Chapter 3: Requirements 4
Virtual appliance minimum resource requirements 4
Desktop and reports consoles software requirements 5
Web console software requirements 5
Chapter 4: Deploying the virtual appliance 6
Preparing installation files 6
Deploying LEM using VMware vSphere 7
Supported and unsupported URLs 8
Deploying LEM using Microsoft Hyper-V 8
Supported and unsupported URLs 9
Configuring a static IP address 9
Connecting to the virtual appliance through the LEM Web Console 10
Chapter 5: Going from evaluation to production 11
Automatically applying a license key in the LEM Web Console (Internet
access required) 11
Manually applying a license key in the LEM Web Console on a computer
without Internet access 12
Activating the virtual appliance using vSphere/Hyper-V SSH-type console 12
Chapter 6: Installing and configuring additional software for accessing
the LEM Virtual Appliance 15
Resolving the LEM Virtual Appliance's hostname for use the LEM Desktop
Console (optional) 15
Installing the SolarWinds LEM Desktop Console (optional) 15
Importing the SSL certificate 16
ii
Contents
iii
Chapter 1: Introduction
SolarWinds Log & Event Manager (LEM) is a state-of-the-art virtual appliance that
adds value to existing security products and increases efficiencies in
administering, managing and monitoring security policies and safeguards on your
network.
SolarWinds LEM is based on brand new concepts in security. You can think of it
as an immunity system for computers. It is a system that is distributed throughout
your network to several “points of presence” that work together to protect and
defend your network. SolarWinds LEM responds effectively with focus and speed
to a wide variety of threats, attacks, and other vulnerabilities.
SolarWinds LEM collects, stores and normalizes log data from a variety of
sources and displays that data in an easy to use desktop or web console for
monitoring, searching, and active response. Data is also available for scheduled
and ad hoc reporting from both the LEM Console and standalone LEM Reports
console.
Some common use cases for SolarWinds LEM include the following:
l Correlating network traffic from a variety of sources using filters and rules.
l Visualizing log data in dynamic graphs, charts and other widgets.
l Monitoring USB mass storage device activity on network Agents.
l Responding to countless threats, attacks and other vulnerabilities with easy
to use point-and-click and automated active responses.
l Searching normalized log data for events of interest.
l Change Management and other security-related reporting for management
and auditors.
1
Chapter 2: Installing LEM
A complete LEM deployment has three basic components:
l The LEM Virtual Appliance collects and processes log and event
information. The virtual appliance is a virtual image of a Linux-based
physical computer. Deploy the LEM Virtual Appliance using either the
VMware vSphere or Microsoft Hyper-V client.
l The LEM Console is an interface to the LEM Virtual Appliance. This
interface is deployed on the web or on a desktop. The LEM Web Console is
available in a web browser after you deploy the LEM Virtual Appliance. The
LEM Desktop Console is an Adobe AIR-based console that requires a
separate installation on your desktop.
l The LEM Reports Console allows you to create reports and schedule
when you to run those reports. The LEM Reports Console is separate
installation on your desktop or laptop computer.
Deploy these LEM components in the following order:
2
Chapter 2: Installing LEM
5. Open the LEM Web Console or install the LEM Desktop Console on your
computer.
6. Install and activate the LEM license to move from an evaluation to a
production deployment.
7. Install the LEM Reports Console on your computer.
3
Chapter 3: Requirements
Different sized installations may require greater or fewer resources. For detailed
information on sizing and resource requirements, refer to the "Requirements"
section of the Log & Event Manager Deployment Guide.
Before installing, always make sure your hardware and software meet
the minimum requirements.
CPU speed 2 GHz
Memory 8 GB
4
Chapter 3: Requirements
l Windows 8 l Windows 10
5
Chapter 4: Deploying the virtual
appliance
Preparing installation files
Double-click the SolarWinds Log and Event Manager.exe file to extract the
application files to a folder on your desktop.
The files in each executable contain the virtual appliance image to deploy
SolarWinds Log & Event Manager using either VMware vSphere or Microsoft
Hyper-V.
Follow the prompts in the QuickStart Log and Event Manager wizard.
The default deployment of the LEM Virtual Appliance uses swi-lem as the
hostname and tries to pull network configurations from the DHCP server. The
hostname and IP address can be changed after completing deployment.
By default, LEM deploys with 8 GB of RAM and 2 CPUs on both vSphere and
Hyper-V platforms.
6
Chapter 4: Deploying the virtual appliance
1. Start the VMware vSphere Client and log on with VMware administrator
privileges.
2. Deploy the OVF template.
3. Browse to select the Deploy First – LEM Virtual Appliance.ova file in the
SolarWinds Log & Event Manager folder on your desktop.
4. Complete the setup wizard.
5. Select the Thin Provisioned disk format.
1. Select the SolarWinds Log and Event Manager virtual appliance and click
Play.
2. Click the Console tab.
3. To start the LEM web console, launch a web browser and enter the Web
Console URL shown in the Console tab.
7
Supported and unsupported URLs
1. Open Hyper-V Manager and select the action to import a virtual machine.
2. Browse to open the SolarWinds Log and Event Manager folder extracted to
the desktop.
4. Copy the virtual machine and duplicate all files. Then select the virtual
machine window and import everything in it.
5. Right-click the newly created SolarWinds Log & Event Manager virtual
appliance and select Settings.
6. Specify Network Adapter for a VM and save the settings.
Note: If a LEM deployment receives greater than 15 million events per day,
its resource reservations must be adjusted. See Configuring resources,
8
Chapter 4: Deploying the virtual appliance
reservations, and storage and the Log & Event Manager Deployment Guide
for information. on configuring resource reservations for a large deployment.
9. Write down the IP Address that displays after the virtual appliance starts up.
10. To start the LEM web console, launch a web browser and enter the Web
Console URL shown in the Console screen.
1. Navigate to the Console tab in the vSphere client or to Action > Connect
in the Hyper-V client.
2. Arrow down to Advanced Configuration and then press Enter.
3. At the cmc> prompt, enter appliance.
9
Connecting to the virtual appliance through the LEM Web Console
l Connecting through the LEM Web Console in a web browser after installing
the LEM Virtual Appliance. No additional installation is required.
l Installing, configuring connectivity, and then connecting through the
LEM Desktop Console. This installation is optional. See Installing the LEM
Desktop Console for more information.
To connect to the virtual appliance using the LEM Web Console:
1. Launch a web browser and enter the web console URL provided during the
configuration of VMware vSphere or Microsoft Hyper-V.
2. The default admin credentials automatically populate the logon dialog, so
click Connect to log on.
3. Create a new password. The first time the LEM Web Console connects to
the LEM Virtual Appliance, it prompts you to change your password. The
password must be between 6 and 40 characters and contain at least one
capital letter and one number.
4. Enter your email address to use the SolarWinds Improvement Program to
send anonymous data about your usage to SolarWinds. If you do not wish to
participate, clear the check box.
5. Click Save.
10
Chapter 5: Going from evaluation to
production
Upgrade your evaluation version of LEM to a fully functional production version in
a few basic steps:
11
Chapter 5: Going from evaluation to production
5. Select Copy to copy the Unique ID of this LEM Virtual Appliance. If the
computer that LEM resides on does not have Internet access at all, manually
copy and paste the Unique ID into a text file and save the file to a shared drive
accessible from a computer that does have Internet access..
9. In the pop-up window, fill in the form, pasting the LEM Virtual Appliance's
Unique ID.
10. Click Generate License File to download your license file to your hard drive.
If your LEM installation is on a computer with no Internet access, save the
license file to a shared drive that your LEM installation can access.
11. In the LEM Console under Manage > Properties > License > License
Activation, select Browse to find the downloaded license file.
12
Activating the virtual appliance using vSphere/Hyper-V SSH-type console
13
Chapter 5: Going from evaluation to production
14
Chapter 6: Installing and configuring
additional software for accessing the
LEM Virtual Appliance
Resolving the LEM Virtual Appliance's hostname
for use the LEM Desktop Console (optional)
The computer running the LEM Desktop Console must be able resolve the
hostname of the appliance via DNS or a manual entry in the hosts file. Failing to
resolve the hostname results in an inability to connect, or an unreliable
communication.
Configure forward and reverse DNS entries (a HOST and PTR record) for your
appliance on your DNS server. When creating the DNS entries, use the default
hostname or the hostname you specified during activation.
If you cannot configure DNS directly on your DNS server, configure a hosts file on
the computer by editing Windows\System32\drivers\etc\hosts in a text editor.
Add a line space and then a line with your virtual appliance’s IP address and
hostname (space or tab separated).
15
Chapter 6: Installing and configuring additional software for accessing the LEM
9. Create a new password. The LEM Desktop Console requires that you
change your LEM password after installation.The first time the LEM Console
connects to the LEM Virtual Appliance, it prompts you to change your
password. The password must be between 6 and 40 characters and contain
at least one capital letter and one number.
10. Enter your email address to use the SolarWinds Improvement Program to
send anonymous data about your usage to SolarWinds. If you do not wish to
participate, clear the check box.
16
Importing the SSL certificate
3. Click Next and select Place all certificates in the following store.
4. Click Browse.
5. Select Trusted Root Certification Authorities, click OK, and then click
Next.
6. Click Finish.
17
Chapter 7: Allocating resources with
reservations
The deployment default for LEM is 250 GB. For larger deployments, 2.0 TB may
be required, which is available when using VMware ESX(i) 4/5+ and Microsoft
Hyper-V 2008 R-2/2012.
LEM deployment requires reservations for system resources in the Virtual
environment. LEM has nearly 500 connectors to receive traffic from a multitude of
different devices on a network. The type of traffic varies depending upon the
device sending the traffic, and the volume of traffic varies depending on audit and
log settings on those devices. This volume of traffic is typically a continuous
stream of traffic that fluctuates slightly due to changes in user needs, server
usage, and network activity.
LEM data is received by connectors, presented in the console Monitor area,
passed through the rules engine for specified actions, and then pushed into a
database for retrieval by the reports application or nDepth search function. To
accommodate processing the data real-time, LEM requires reservations from the
VM host.
When the volume of traffic exceeds 15 million events per day, reservations must
be increased.
See the Log & Event Manager Deployment Guide's "Introduction" and
"Deployment Basic Principals" sections for details on setting the right
reservations for your large, medium, or small LEM deployment.
18
Chapter 7: Allocating resources with reservations
Field Description
Platform Displays the name of the Manager platform, which can
be Trigeo SIM, VMware vSphere, or Microsoft HyperV.
CPU Reservation Shows how much CPU memory has been reserved.
Reserving CPU memory ensures enough resources
are available for the allocated CPUs. For example,
reserving 2 GB of memory ensures the virtual appli-
ance always has 2 GB of physical memory.
Number of CPUs Defines the number of processors (or cores) allocated
to the virtual appliance.
Memory Allocation Displays the maximum amount of memory the Man-
ager can use. Set this value at or above the reser-
vation value. Defined this value in the VM
configuration. Setting memory allocation to a greater
value than the memory reservation has little effect on
LEM performance.
Memory Reservation Indicates how much memory has been reserved for
19
Viewing virtual appliance resources, reservations, and storage
Field Description
this system. Reserving memory ensures enough sys-
tem memory is available when needed.
Status Shows the Manager’s or the appliance’s current
connection status.
Name Displays the Manager’s or the appliance’s name.
Type Indicates the appliance type, which is either Manager,
Database Server, nDepth Server, Logging Server,
or Network Sensor.
Version Shows the version of the Manager or appliance
software.
IP Address Displays the Manager’s or the appliance’s IP address.
Port Exhibits the port number the Console uses to
communicate with the Manager or the appliance.
4. Select the Resource Allocation tab, and note the CPU reservation on the
left and the Memory reservations on the right.
5. At the bottom right, set an 8 GB memory reservation. Set the limit to
unlimited.
20
Chapter 7: Allocating resources with reservations
The Configured amount must be at least the same value or higher than
the reservation. You may see memory reservations as high as 256 GB
of RAM for customers over 150 million events per day.
l Static ram set to 8 GB, 16 GB, 24 GB, 32 GB, 64 GB, 128 GB, 256 GB
l Memory Weight must to be set to High.
1. Select the Advanced tab to set view and set the details for CPU memory.
2. Set the CPU Priority to High.
3. Set the Reserve CPU cycle to 100%.
4. Set the Limit CPU cycles to 100%.
21
Chapter 8: Installing the LEM
Reports Console
The easiest way to install the SolarWinds Log & Event Manager Reports is from
the Quick Start: Log and Event Manager splash screen.
If your Windows security settings prevent the LEM Reports Console and the
Crystal Reports Runtime combination installation, you will need to download the
individual LEM Reports Console and the Crystal Reports Runtime installers from
the SolarWinds Customer Portal.
2. Click Run.
3. Click Next.
4. Review the Requirements for Installation information and then click Next.
6. Click Next.
22
Chapter 8: Installing the LEM Reports Console
http://downloads.solarwinds.com/solarwinds/Release/LEM/SolarWinds-
LEM-v6.0.1-CrystalReportsRuntime.zip.
2. Extract the installer file(s) and place each installer on the local hard drive on
the computer that the reports console will be installed on.
3. Run the Crystal Runtime Installer first.
a. Right-click the installer and select Run as administrator to launch the
install.
b. Follow the installer instructions.
4. Run the LEM Reports installer.
a. Right-click the installer and select Run as administrator to launch the
install.
23
Automatically installing LEM Reports Console from the LEM Console
24