ELM Log Manager 5.x is Now a Log License in ELM Enterprise Manager 6.0

ELM Log Manager is a comprehensive windows event, syslog and snmp collection, monitoring and alerting solution. With the release of ELM version 6.0, ELM Log Manager has now become a "Log license" that is offered through TNT Software's flagship product ELM Enterprise Manager. ELM Log Manager version 5.5 is still fully supported. This new licensing model introduced in ELM 6.0 has combined all of our previous ELM product versions into a single, all encompassing product, with multiple licensing options. In versions of ELM prior to 6.0, only a single product could run in a given environment. For example, if you were primarily interested in just WIndows Event Logs, but also had a few network devices from which you needed to collect and monitor logs from, then you would need to run ELM Log Manager, even though you did not necessarily need all the functionality it provided.

Now, with the new flexible licensing model in ELM Enterprise Manager 6.0, you have the ability to purchase and install the licenses that fit the best given the monitoring capabilities you need.

For example, on Windows Servers where you just want event logs, you could use Event Licenses. On those network devices you would use Log Licenses; and now you can also choose to run System Licenses on the machines where you need more comprehensive monitoring of events, applications, processes, services and status/health.

ELM Product Upgrade Path: ELM Enterprise Manger --» System License ELM Log Manager --» Log License ELM Performance Manager --» Performance License ELM Event Log Monitor --» Event License

Comprehensive system monitoring capabilities: Log Management Health & Status Monitoring Application & Service Monitoring Resiliency - Fault Tolerance Checking

Click here to compare features in ELM Enterprise Manager 6.0

Click here for sample scenarios of a mixed license environment

Log Management Features Available In ELM Enterprise Manager 6.0

Search Events

ELM provides a powerful Event Search feature within the ELM Editor reporting tools. If you are looking for information on a specific event ID or a user account, you can now do a search right within the ELM Console.

Search on different event types including errors, warnings, informational, audit success, audit failure, critical and verbose.

Narrow down search results by Computer Name, Event ID, Source, Category, User or Message.

(This search feature is also found in the ELM Web Viewer.)

Event Log Alarms     

The Event Alarm compares the new event against a customized Event Filter. If the event matches or fails to match the criteria the specified number of times within the specified time period, the Action is executed.

This is a convenient tool to detect the absence of a system back-up confirmation event.

Event Log Collector     

The Event Collector monitors all Windows event logs and when an event match to a specified Event Filter is determined, it is expanded and transferred to the ELM Server. The collected events are reliably stored in the Primary database for reporting, Filtered to create concise Views, and used to trigger a Notification. Typically, very general Filters are configured to ensure all the data is available for accurate analysis.

Event File Collector     

The Event File Collector operates to collect and store the native event log files. (.EVT and .EVTX). These files are securely stored by default in the EVT File sub-directory under the ELM Enterprise Manager installation folder. They provide an authentic source for event log management.

Flat File Monitoring     

The File Monitor scans ASCII or plain text files or groups for files on a scheduled basis for a specified character string. When a match is found, an Action can be triggered. Commonly monitored files include:

SNMP Alarm     

The SNMP Alarm includes a MIB browser that queries a SNMP Object ID (OID) and triggers an Action if the value is greater than, less than, or equal to a specified value. It extends the status monitoring of ELM beyond Windows systems and into SNMP supported network devices.

SNMP Collector     

The SNMP Collector monitors on a scheduled basis the SNMP Object ID’s and returns the values to the ELM Server. They are stored in the Primary Database for reporting and trending.

SNMP Receiver     

The SNMP Receiver is configured to process SNMP Traps from network devices. These traps can be translated against stored .mibs and converted into a Windows event log format. Like Windows events, they are stored in the Primary database for reporting, Filtered to create concise Views and used to trigger a Notification. Use ELM event log management technologies monitor non-Windows systems.

SNMP Trap with OIDs shown:

Warning
TEST3
1/19/2010 7:49:13 PM
1/19/2010 7:49:13 PM
{0A282598-0136-4222-ADCC-431B9DDE30BC}
2000
SNMP
None
SPECIFIC TRAP
None
Enterprise specific trap id 0
Host Address: TEST3.tnttestlab.com (127.0.0.1)
.iso.org.dod.internet.private.enterprises.lanmanager.2.1 = TEST3
.iso.org.dod.internet.private.enterprises.lanmanager.2.2 = 0
.iso.org.dod.internet.private.enterprises.lanmanager.2.3 = Audit Success
.iso.org.dod.internet.private.enterprises.lanmanager.2.4 = Application
.iso.org.dod.internet.private.enterprises.lanmanager.2.5 = Source
.iso.org.dod.internet.private.enterprises.lanmanager.2.6 = Category
.iso.org.dod.internet.private.enterprises.lanmanager.2.7 = Username
.iso.org.dod.internet.private.enterprises.lanmanager.2.8 = This is a test event message.

SNMP Trap without OIDs Shown:

Warning
TEST3
1/19/2010 7:49:41 PM
1/19/2010 7:49:41 PM
{30202DE3-57EB-4B93-B63A-4DB9408A972A}
2000
SNMP
None
SPECIFIC TRAP
None
Enterprise specific trap id 0
Host Address: TEST3.tnttestlab.com (127.0.0.1)
TEST3
0
Audit Success
Application
Source
Category
Username
This is a test event message.

Syslog Receiver     

The Syslog Receiver is configured to process Syslog messages from network devices and UNIX-based systems. Supporting both UDP and TCP, these messages are converted using the standard Windows event log format. Like Windows events, they are stored in the Primary database for reporting, Filtered to create concise Views and used to trigger a Notification. When used to supports firewalls, they fortify the security barrier around Windows networks.