How does ESM actually work? Does it parse log files?

ESM operates a server-agent architecture. Collection agents are deployed on each of the nodes being monitored, and a single instance of the server application runs on a designated machine. The server application lets agents report in with their metrics, writes them to a dedicated database, and serves the front-end thin client web interface to users.

The collection agents monitor each process in real time, similar to native OS process monitors such as top, prstat or Task Manager. ESM does not depend on any logfiles to derive its performance data andrequires no changes to existing logging configuration. ESM does however keep track of batch execution logs, allowing any warnings or errors to be plotted against the performance data in real time.