ProLiant Servers (ML,DL,SL)
Showing results for 
Search instead for 
Do you mean 

Reading and erasing iLO logs without losing events between operations

Occasional Visitor

Reading and erasing iLO logs without losing events between operations

I need to record iLO logs (such as server resets, power failures or invalid logins) into Windows Events. I developed a program that captures ouput of the following:

 

  hponcfg.exe /f get_ilo_log.xml

 

Where get_ilo_log.xml is defined as:

 

<RIBCL version="2.21">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="READ" >
<GET_EVENT_LOG />
</RIB_INFO>
</LOGIN>
</RIBCL>

 

After this, the program calls hponcfg.exe again, in order to erase logs with the following script:

 

<RIBCL VERSION="2.0">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="write">
<CLEAR_EVENTLOG/>
</RIB_INFO>
</LOGIN>
</RIBCL>

 

The problem is that we lose all iLO events happening in the time between reading the logs and erasing them. This is particularly bad during a Denial of Service atack, where we cannot lose any iLO event.

 

So I need a way to safely erase iLO logs without losing anything. It would be nice if I could either query or erase only logs from a date range or other filter.

3 REPLIES
Trusted Contributor

Re: Reading and erasing iLO logs without losing events between operations

Not sure if this will work, but why not combine your scripts.

<RIBCL version="2.21">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="READ" >
<GET_EVENT_LOG />
<CLEAR_EVENTLOG/>
</RIB_INFO>
</LOGIN>
</RIBCL>

This way the Read and Erase are run as close together as possible.
Occasional Visitor

Re: Reading and erasing iLO logs without losing events between operations

[ Edited ]

Thanks, but I guess it's not enough. This reduces window of lost events, but does not prevent them.

Highlighted
HPE Pro

Re: Reading and erasing iLO logs without losing events between operations

You might try something like this

 

<RIBCL version="2.21">

<LOGIN USER_LOGIN="adminname" PASSWORD="password">

 

<RIB_INFO MODE="READ" >

   <GET_EVENT_LOG />

</RIB_INFO>

 

<RIB_INFO MODE="write">

  <CLEAR_EVENTLOG/>

</RIB_INFO>

 

</LOGIN>

</RIBCL>




__________________________________________________
No support by private messages. Please ask the forum!      I work for HPE

If you feel this was helpful please click the KUDOS! thumb below!