Installation
Highlighted

License_usage.log: How to find what system/host is sending certain log entries and if these count against my license?

Motivator

I have this log entry in the "license_usage.log" file

10-20-2014 23:56:16.888 -0500 INFO LicenseUsage - type=Usage s="" st="WinEventLog:Application" h="" o="" i="27AA4E28-C9C6-4177-84F1-9A79462121BB" pool="auto_generated_pool_enterprise" b=55412 poolsz=xxxxxxxxxxxx

I don't know what system is sending these logs. How do I know what system is sending these logs and if I am being charged for the logs from this system?

Labels (1)
0 Karma
Highlighted

Re: License_usage.log: How to find what system/host is sending certain log entries and if these count against my license?

Builder

One thing I thought of is using netstat on your indexer(s) to identify IPs of all TCP connections to 9997 and work through the IPs. Another is to search your index(es) for events with anomalous host fields for sourcetype="WinEventLog:Application"

0 Karma
Highlighted

Re: License_usage.log: How to find what system/host is sending certain log entries and if these count against my license?

Builder
0 Karma