How does it communicate?
Agents push to the virtual appliance using the ports listed here
SolarWinds Knowledge Base :: SolarWinds LEM Port and Firewall Information
specifically,
| 32022 | TCP | Non-standard port for SSH traffic to the SolarWinds LEM appliance |
| 37890-37892 | TCP | Traffic from SolarWinds LEM Agents to the SolarWinds LEM appliance |
Frequency?
By default each enabled connector has a sleep time of 1 second. The frequency is configurable. So, it is real-time for all practical purposes.
Logging activities and amount of log data?
It depends on the connectors enabled. By default, connectors for Security, System and Application event logs are enabled. The communication is encrypted and compressed. In most cases, it is a steady trickle roughly equivalent to an LDAP request (i.e., negligible network overhead)