SolarWinds Event Log Consolidator vs Alternatives: Which Is Right for You?

SolarWinds Event Log Consolidator: Complete Guide to Setup and Best Practices—

SolarWinds Event Log Consolidator (ELC) helps centralize, normalize, and manage Windows event logs from multiple systems into a single repository for easier monitoring, troubleshooting, and compliance. This guide covers planning, installation, configuration, ingestion methods, filtering and normalization, alerting and reporting, performance tuning, security considerations, maintenance, and troubleshooting best practices.

What ELC does and when to use it

ELC collects Windows Event Logs (Application, System, Security, and custom channels) from multiple servers and workstations, consolidates them into a central store, and provides search, filtering, retention, and export capabilities. Use ELC when you need:

Centralized visibility into events across many hosts
A lightweight, on-premises solution for event aggregation (as opposed to full SIEM)
Improved troubleshooting by correlating events from multiple systems
Meeting regulatory retention or auditing requirements for event logs

Planning and prerequisites

Before deployment, plan along these lines:

Inventory the hosts whose events you will collect and estimate event volume (events/sec, average event size).
Decide on collection method: agent-based (recommended for feature-rich collection) vs. agentless (WMI/WinRM).
Storage sizing: plan for raw event retention period and growth. Include indexes and overhead—typical overhead 20–40% over raw data.
Network bandwidth: ensure reliable connectivity between sources and ELC server(s).
Security and permissions: account for least-privilege collection accounts, certificate requirements, firewall rules, and secure communication (TLS).
High availability: decide whether to deploy redundant ELC servers, load balancers, or use a separate archive store.
Compliance/retention policies and backup strategy.

Prerequisites (typical):

Windows Server (supported version per SolarWinds documentation)
.NET Framework (specific version required by your ELC build)
SQL Server (for database-backed configurations) or sufficient local disk for file-based storage
Administrative credentials for target hosts (if using agentless collection)
Proper firewall and WinRM/WMI configuration if using agentless collection

Installation

Download the ELC installer from SolarWinds (ensure using the approved build for your environment).
Install on a dedicated server when possible. Run installer as Administrator.
Follow the installer wizard to select components (collector, web console, database).
Configure database settings (SQL Server instance, credentials) during setup or point to local storage if supported.
Configure service account for the ELC service—least privilege but with necessary rights for service operation and event collection.
Open required firewall ports (default ports vary by version; common ones include TCP 445 for SMB, WinRM ports ⁄₅₉₈₆, and any custom collector ports).
Apply latest patches and product hotfixes after installation.

Collection methods: agent vs agentless

Agent-based collection:

Pros: more reliable across intermittent networks, better metadata, secure persistent connection, easier to collect logs from laptops and mobile endpoints.
Cons: requires deploying and managing agents on each host.

Agentless (WMI/WinRM):

Pros: no software deployment on endpoints, easier initial setup for a small number of servers.
Cons: higher load on the collector, can be less reliable, may require elevated credentials and WinRM configuration.

Recommendation: Use agents for large environments or when collecting from unstable networks; use agentless for small, static server fleets.

Configuring sources and log channels

Add hosts by hostname, IP, or import from Active Directory/Inventory.
For each host, select channels to collect (Application, System, Security, or custom). Collecting the Security channel may require special permissions (SeAuditPrivilege).
Use grouping (by role, location, OS) to apply consistent collection and filtering policies.
Enable or schedule initial full harvest for historical logs where needed.

Filtering and normalization

Filter at source where possible to reduce volume: exclude verbose debug events, collect only specific event IDs or event levels (Error, Warning, Critical).
Normalize event fields into a consistent schema: timestamp (UTC), host, source, eventID, level, message, user, process.
Apply enriched parsing for common event types (e.g., Windows Update, Group Policy, authentication events) to extract useful fields (account name, IP address, failure reason).
Use discard and sampling policies for high-volume events to control storage.

Indexing, search, and retention

Configure indexing on commonly queried fields (timestamp, host, eventID, level, user) to speed searches.
Retention: set short retention for high-volume, low-value logs and longer retention for security/audit logs. Implement tiered storage—hot index on SSD for recent data, colder HDD or archive for older data.
Implement regular index maintenance (rebuild/optimize) to retain query performance.

Alerting and correlation

Create alerts for actionable conditions: repeated authentication failures, service crashes, critical hardware events.
Use correlation rules to combine related events across hosts (e.g., multiple failed logins followed by an account lockout) to reduce noise.
Configure alert thresholds and suppression windows to avoid alert storms during maintenance windows.
Integrate alerts with ticketing/notification systems (email, Slack, PagerDuty).

Reports and dashboards

Build dashboards for key operational views: recent critical errors, highest event-generating hosts, authentication failures, and compliance summaries.
Schedule regular reports (daily/weekly) for ops and security teams. Export options: PDF, CSV, or direct integration with SIEMs.
Use saved searches and templates for recurring investigations.

Performance tuning

Monitor collector CPU, memory, disk I/O, and network utilization.
Tune collection intervals and batching to balance latency and resource use.
Increase indexing resources (RAM, CPU) or distribute indexing across nodes for heavy query loads.
Use SSDs for hot index and high-write workloads; RAID configuration for durability.
Adjust database maintenance jobs (backups, index rebuilds) to off-peak times.

Security considerations

Use TLS for communications between agents/clients and the ELC server.
Secure service accounts: use managed service accounts or least-privilege domain accounts; rotate credentials periodically.
Harden the ELC server: disable unnecessary services, apply OS hardening guides, keep patching current.
Protect stored logs: encrypt at rest if possible and control access with role-based access controls (RBAC).
Log integrity: enable checksums or WORM/archive options for compliance-sensitive logs.

Backup and disaster recovery

Backup database and configuration regularly; test restores.
Archive older logs to immutable storage for long-term retention (cloud object storage or WORM-compliant local archive).
Prepare recovery runbooks and RTO/RPO targets.
Consider deploying a secondary ELC in a different site for failover.

Maintenance tasks and lifecycle

Regularly review and prune filters to avoid missing important events.
Update agent software and server components on a scheduled cadence.
Review storage growth and retention settings quarterly.
Conduct periodic audits of who has access to logs and alert subscriptions.

Common issues and troubleshooting

Missing events: check collector connectivity, permissions, and channel subscription; verify source event service is running.
High disk usage: review retention settings, enable compression, or increase storage tiering.
Slow searches: check index health, increase indexing resources, or refine queries.
Duplicate events: ensure duplicate suppression is enabled and check clock skew between hosts.

Best practices checklist

Inventory event sources and estimate volume.
Use agents for large or unreliable environments.
Filter at source and normalize events.
Index key fields and implement tiered retention.
Create meaningful alerts and use correlation rules.
Secure transport and stored logs; use RBAC.
Backup configs and archive logs to immutable storage.
Monitor ELC performance and adjust resources.

Appendix — Example configuration snippets

Agent installation (PowerShell example):

# Install ELC agent MSI silently msiexec /i "SolarWindsELC_Agent.msi" /qn /norestart # Configure agent to point to collector ELCAgentConfig.exe /server collector.example.local /port 6514 /useTLS true /register

Example normalized event JSON schema:

{   "timestamp": "2025-09-01T12:34:56Z",   "host": "host01.example.local",   "eventID": 4625,   "level": "Error",   "source": "Microsoft-Windows-Security-Auditing",   "user": "DOMAIN\user",   "message": "An account failed to log on.",   "ipAddress": "10.1.2.3" }

If you want, I can convert this into a printable PDF, create alert rule examples for specific event IDs, or produce a deployment checklist tailored to your environment.