The trial ends on a date, not with a warning shot. Offices discover this on day 31, staring at a console that has politely stopped being fully theirs. Ten minutes of planning during the trial makes the transition a non-event.
EventLog Analyzer's evaluation is generous: a 30-day, fully functional trial, and after it a Free edition that continues with up to five log sources. Paid licensing is counted by the number of log sources you monitor. This page is the calm path between those states: what to count, what to decide during the trial, and how to apply a licence so your collected history and configuration carry through untouched.
The worst use of a 30-day trial is installing it on day one and looking at it on day twenty-nine. The trial is your measurement window: real event volumes for the sizing math, your true baseline for alert thresholds, and the honest list of sources that earned their place.
By the last week you should be able to say, in numbers, how many sources you need now, how fast the disk grows, and which five reports the office actually reads. That paragraph is your purchase justification, already written.
Licensing is counted by log sources: each Windows device, syslog device, or other system sending logs into the console is one source, regardless of how much data it produces. Your DCs, the firewall, each server and each workstation all count individually.
Count what you genuinely monitor, not everything that exists. The rollout order in this series exists partly for this: the five sources that answer real questions first, then deliberate additions. Buying for the whole estate on day one usually means paying for workstation noise nobody reads.
If budget is not ready when the trial ends, the Free edition keeps up to five log sources collecting. Chosen well, DCs, the firewall and your most important servers, that is a real, working log system for a small office, not a demo.
Be honest about the limits though: beyond five sources you are blind on the rest of the estate, and paid editions add the depth larger networks need. The free tier is a bridge and a small-office answer, not a strategy for a growing network.
Applying a licence changes permissions, not data; the database, configuration and collected logs carry over. Verify anyway. The five minutes of checking is what separates a transition from a surprise.
Licences expire like trials do. Put the renewal date in the same calendar that holds your monthly log review, a month ahead, with the current source count attached. Renewal time is also the honest moment to reconcile: sources added during the year, sources retired, and whether the count still matches what you pay for.
And keep the purchase paperwork with the retention policy. Together they answer the two questions every log system eventually faces: how long do we remember, and who decided.
Start the trial with the install in the video, and let this page turn day 30 from a deadline into a decision you already made.
▶️ Watch Full VideoNo. The trial expiring changes the edition's limits, not your data. Logs already collected stay in the database, and applying a paid licence to the same install restores full function with your history intact. Verify with a search for an older event after applying, as this page suggests.
By the number of log sources you monitor, in edition tiers, rather than by log volume. Exact figures change over time and by region, so this guide deliberately prints none; count your sources, then check ManageEngine's current licensing page for the live numbers.
Yes. The free edition covers up to five log sources on the same product, and moving to a paid licence is an application of a licence file, not a reinstall. Start free with your DCs and firewall if that is what budget allows, and grow when the questions outgrow five sources.