topic 3par remote syslog Message Severity in HPE 3PAR StoreServ Storage

3par remote syslog Message Severity

nsnidanko — Mon, 30 Mar 2015 14:02:16 GMT

We forward all syslogs to remote server. 3PAR 3.1.3 MU2 seems to have a bug where it classifies the following message as Critical.

3PAR_###### cli_command es_vss_4_windows VSS Snapshot creation success

Is there a way to chage Message Severity behaviour for certain logs?

Re: 3par remote syslog Message Severity

Prakash Singh_1 — Mon, 30 Mar 2015 17:08:00 GMT

HI,

PF the attached message syslog settings

Re: 3PAR remote syslog Message Severity

Dennis Handly — Tue, 31 Mar 2015 16:35:07 GMT

Based on what Prakash Singh_1 attached, can you find the command in showeventlog that is being sent?

Re: 3PAR remote syslog Message Severity

nsnidanko — Thu, 02 Apr 2015 13:59:20 GMT

Hi Prakash,

Thank you, I've remote syslog configured already.

Hi Dennis,

Yes, I was able to track it in the showeventlog

Time : 2015-02-24 07:32:50 EST
Severity : Informational
Type : CLI command executed
Message : {3parrm edit all {{0 4}} -1 10.*.*.100 8613} {userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}} {}

As you can see 3par forwards it with "Major" severity .

Re: 3PAR remote syslog Message Severity

Dennis Handly — Thu, 02 Apr 2015 19:59:16 GMT

>I was able to track it in the showeventlog

This was the command that created the event. There should be the real event with major close by.

It seems this was created by some recovery manager: 3parrm

Re: 3PAR remote syslog Message Severity

nsnidanko — Thu, 02 Apr 2015 20:40:11 GMT

Yes, you're correct. This account is used by 3PAR Recovery Manager for SQL, which takes snapshots every hour and replicates it to second array.

There is an event with major, generated by command above. Here's what it looks like:

Time : 2015-04-02 07:33:19 EDT
Severity : Informational
Type : Notification
Message : Start snap vss0001**7_rw_040******242 (id=6815) from parent vss0001**7_ro_0402******42 (id=6813) on nodes 0x03

Time : 2015-04-02 07:33:19 EDT
Severity : Informational
Type : CLI command executed
Message : {3parrm edit all {{0 4}} -1 10.*.*.50 30035} {userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}} {}

Time : 2015-04-02 07:33:19 EDT
Severity : Major
Type : CLI command executed
Message : VSS Snapshot creation success

I am following you now; Recovery Manager software has a bug because it's issuing this command:

userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}

It should be:

userevent -type command -severity informational -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}

I will open ticket with HP and notify about this bug.

Re: 3PAR remote syslog Message Severity

Dennis Handly — Fri, 03 Apr 2015 12:42:48 GMT

>It should be: userevent -type command -severity informational

Or at least not major.