Installation

License_usage.log: How to find what system/host is sending certain log entries and if these count against my license?

hartfoml
Motivator

I have this log entry in the "license_usage.log" file

10-20-2014 23:56:16.888 -0500 INFO LicenseUsage - type=Usage s="" st="WinEventLog:Application" h="" o="" i="27AA4E28-C9C6-4177-84F1-9A79462121BB" pool="auto_generated_pool_enterprise" b=55412 poolsz=xxxxxxxxxxxx

I don't know what system is sending these logs. How do I know what system is sending these logs and if I am being charged for the logs from this system?

Labels (1)
0 Karma

chanfoli
Builder

One thing I thought of is using netstat on your indexer(s) to identify IPs of all TCP connections to 9997 and work through the IPs. Another is to search your index(es) for events with anomalous host fields for sourcetype="WinEventLog:Application"

0 Karma

chanfoli
Builder
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!