Monitor ITOM logs with ManageEngine Log360

ManageEngine Log360 integrates seamlessly with key components of the ManageEngine ITOM suite including OpManager, NetFlow Analyzer, Network Configuration Manager, and Firewall Analyzer and ingests application and access logs. This enables your SOC teams to identify and analyze successful and failed logon attempts, server errors, unauthorized access attempts, and more from a single unified console.

How Log360 collects and processes ITOM logs

Syslog forwarding: ManageEngine ITOM applications are configured to forward their logs (serverout file and Access log file) to the Log360 server via the syslog protocol.

Import logs: ManageEngine ITOM applications are configured as log sources in Log360 by navigating to Settings > Log Source Configuration > Applications > ManageEngine Applications.

Note: You can import logs via local directories, shared UNC paths, SFTP, or cloud storage.

From the ITOM suite, you can forward details about all the requests made to your server and events in the application life cycle. These collected logs are then normalized and enriched by Log360 for correlation, incident management, and more.

Monitoring capabilities

Log360 supports and analyzes the ITOM suite's application and access logs to help monitor:

Access logs: Monitor every HTTP request made to the ITOM product (i.e., OpManager, AppManager, NetFlow Analyzer). This enables you to make sense of access patterns and detect issues related to malicious access and server errors.

Debug events: Analyze application-level exceptions and errors captured in debug logs. This helps you detect misconfigurations, internal processing issues, or integration failures within ITOM tools.

Resource access patterns: Monitor which ITOM modules are accessed most frequently and by whom.

Troubleshooting insights: Leverage detailed error codes, response times, and module-level failures from debug logs.

How Log360 helps you leverage ITOM logs

• Configure alerts to get triggered upon interface failures, threshold breaches, and service downtime.
• Correlate device and application issues with security logs, like AD, firewall, or endpoint, to determine whether an operational issue is linked to a cyberattack or misconfiguration.
• Troubleshoot issues faster by aligning ITOM alerts with endpoint or firewall logs.