HPE 3PAR StoreServ Storage
1748202 Members
2975 Online
108759 Solutions
New Discussion

Re: 3PAR remote syslog Message Severity

 
nsnidanko
Occasional Advisor

3par remote syslog Message Severity

We forward all syslogs to remote server. 3PAR 3.1.3 MU2 seems to have a bug where it classifies the following message as Critical.

 

3PAR_###### cli_command es_vss_4_windows VSS Snapshot creation success

 

Is there a way to chage Message Severity behaviour for certain logs?

 

 

6 REPLIES 6
Prakash Singh_1
HPE Pro

Re: 3par remote syslog Message Severity

HI,

 

PF the attached message syslog settings

Regards,

PS
To assign points on this post? Click the white Thumbs up below!
Dennis Handly
Acclaimed Contributor

Re: 3PAR remote syslog Message Severity

Based on what  Prakash Singh_1 attached, can you find the command in showeventlog that is being sent?

nsnidanko
Occasional Advisor

Re: 3PAR remote syslog Message Severity

Hi Prakash,

 

Thank you, I've remote syslog configured already.

 

Hi Dennis,

 

Yes, I was able to track it in the showeventlog

 

Time     : 2015-02-24 07:32:50 EST
Severity : Informational
Type     : CLI command executed
Message  : {3parrm edit all {{0 4}} -1 10.*.*.100 8613} {userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}} {}

 

As you can see 3par forwards it with "Major" severity .

Dennis Handly
Acclaimed Contributor

Re: 3PAR remote syslog Message Severity

>I was able to track it in the showeventlog

 

This was the command that created the event.  There should be the real event with major close by.

It seems this was created by some recovery manager: 3parrm

nsnidanko
Occasional Advisor

Re: 3PAR remote syslog Message Severity

Yes, you're correct. This account is used by 3PAR Recovery Manager for SQL, which takes snapshots every hour and replicates it to second array.

 

There is an event with major, generated by command above. Here's what it looks like:

 

Time : 2015-04-02 07:33:19 EDT
Severity : Informational
Type : Notification
Message : Start snap vss0001**7_rw_040******242 (id=6815) from parent vss0001**7_ro_0402******42 (id=6813) on nodes 0x03

 

Time : 2015-04-02 07:33:19 EDT

Severity : Informational
Type : CLI command executed
Message : {3parrm edit all {{0 4}} -1 10.*.*.50 30035} {userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}} {}

 

Time : 2015-04-02 07:33:19 EDT
Severity : Major
Type : CLI command executed
Message : VSS Snapshot creation success

I am following you now; Recovery Manager software has a bug because it's issuing this command:

userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}

 

It should be:

 

userevent -type command -severity informational -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}

 

I will open ticket with HP and notify about this bug.

Dennis Handly
Acclaimed Contributor

Re: 3PAR remote syslog Message Severity

>It should be: userevent -type command -severity informational 

 

Or at least not major.