topic Re: SIM 7.2 event reporting in Server Management - Systems Insight Manager

SIM 7.2 event reporting

BuddyD — Mon, 15 Apr 2013 19:59:04 GMT

Hi folks,

I can't seem to get the CMS to update the event log. If I "disable" a redundant power supply on a HP DL380 G7 I see the minor notification in the System Status box, as well as in the HS column next to the affected server. However, nothing gets logged to the Events summary so needless to say, no email/pager alert is received. It is reporting log in and log out events, as well as non-pingable systems.

What did I miss??!

Thanks in advance.

BuddyD

Re: SIM 7.2 event reporting

BPE — Mon, 15 Apr 2013 20:18:53 GMT

By default there is no email from such events. You need to check your Event handling Tasks. To see what kind of event will send you an email or log to the event log.

Re: SIM 7.2 event reporting

BuddyD — Tue, 16 Apr 2013 14:38:30 GMT

Thanks for the response, but no matter what I do, the event never gets reported to the event log and that's the problem. I'm getting emails when I log in or log out because THAT gets reported to the event log. But major, minor hardware events do not. So I guess my question is, where is this controlled?

Yes, I'm new to SIM so...please excuse my lack of knowledge re: the product.

Thanks again.

Re: SIM 7.2 event reporting

J_N_Rhodes — Tue, 16 Apr 2013 20:38:34 GMT

BuddyD

Enable E-mail Notifications in HP SIM

Carry out the following:

Options > Events > Automatic event handling > E-mail Setings

and input your SMTP Server details etc. You will notice on this screen there is only the option to send a test e-mail.

To set up the event notification:

Options > Events > Automatic event handling > New task

you can now go through the wizard and define which systems, which events, e-mail recipients etc.

If my post was useful, please clik on "White Star" to award me kudos :)

Re: SIM 7.2 event reporting

BuddyD — Wed, 17 Apr 2013 13:18:23 GMT

Thanks for the response, J-N. I can successfully send myself test email, this has worked without issue right along. To your second recommendation for setting up event notifications: I've created an all events, all systems, send email and write to system log event handler and saved it.

When I pull the plug on one of my DL380 G7 ESXi servers, I observe the "minor" icon in system status in SIM increment to 1, alerting me to a problem. If I then go to all systems, I see the "minor" icon displayed in the HS column of the affected server. If I then click on Events, and under View "all events", there is no indication/report of a "minor" problem. The only "events" being reported/logged by the CMS seems to be "informational", "critical" or "normal". "Major", "Minor" and "Warning" are not being logged/reported and this is the whole problem.

Is this a "bug/feature" or have I missed something obvious??! Has anyone else run into this and been able to get it resolved?

Again, thanks for the response, J_N.

Re: SIM 7.2 event reporting

LGentile — Wed, 17 Apr 2013 14:15:47 GMT

You didn't mention ESXi until now. This may be due to needing to subscribe to WBEM events.

Select your ESXi host, go to Options - Events - Subscribe to WBEM events and run the task. Perform the PSU test again and see if the event appears.

For ESXi, SNMP is not adequate, it requires you to subscribe to WBEM events so SIM will accept them. You can even create an event handler to auto-subscribe when new ESXi hosts are added to a specific collection. This is what i've done.

Re: SIM 7.2 event reporting

BuddyD — Wed, 17 Apr 2013 15:19:52 GMT

Thanks LGentile. I have done this over the past week or so with no luck. As you mention, my research showed that I needed to use WBEM and not SNMP and I have subscribed a number of times with the same result.

I will run through it one more time, but it seems to me if the ESXi events show up on the CMS (Win) host, it's not a communication issue and WBEM is operating as it should. Again, why is SIM failing to report/log events such as I've mentioned before. I was hoping this would be the easy piece, HP hardware talking to HP software....

Thanks again for the response/help, I'll update if anything changes.

Re: SIM 7.2 event reporting

Tushar Bajpai — Thu, 18 Apr 2013 10:32:24 GMT

Health Status gets updated based on Hardware status polling and AOE ( Action On Event) Email / Event log is triggered when an trap / Indication is encourted by the CMS.

Please verify if there is any Trap / Indication that got logged.

From the description it looks like CMS didn't recieved any thing and so no AOE.

Re: SIM 7.2 event reporting

BuddyD — Thu, 18 Apr 2013 18:54:45 GMT

Thank you, Tushar.

Where/how does the System and Health status get separated from the Event logging? WBEM is updating the first two, why doesn't the CMS log the event and/or where is this controlled? I am unable to find it in any menu/pull down.

Re: SIM 7.2 event reporting

LGentile — Fri, 19 Apr 2013 11:27:20 GMT

I haven't encountered this issue before. Normally once I can see health status and subscribe to events, the notifications/events come in OK.

You may need to resort to a packet sniffing tool like Wireshark to see if your CMS is actually getting the messages. Unfortunately, for WBEM I am not aware of a way to intercept the messages with another tool. If it were SNMP you can set up the SNMP trap service (assuming your CMS is Windows), but in this case that wouldn't help you.

You said something strange earlier.. so you ARE getting Minor events, just not major/critical? A power supply removal is 'Major' or 'Critical' i believe. Can you paste the event text here? What I am asking is - is the PSU removal event actually showing up, but only as a minor event? Just for clarification...

Re: SIM 7.2 event reporting

BuddyD — Mon, 22 Apr 2013 12:31:41 GMT

Yes, it's showing up as a minor event. We simply pull the plug and it reports as being minor, but the event never gets logged. I'll post the actual results if/when I have a chance to remove the power again.

Re: SIM 7.2 event reporting

BuddyD — Mon, 22 Apr 2013 13:52:06 GMT

Re: SIM 7.2 event reporting

BuddyD — Mon, 22 Apr 2013 13:58:07 GMT

Another view of the "event". As stated previously, no logging is taking place for this.

Re: SIM 7.2 event reporting

Tushar Bajpai — Mon, 22 Apr 2013 14:28:07 GMT

Traps and Indications which gets logged as System Events and get reflected as aggregated status of the event or overall status of the node. This is dependent on provider or the agent on the target node to update the CMS.

But in case of Heath status CMS goes and checks the node for memory, power, network etc and the same is reflected on the system page as real time data. In this case we are not depedent on the provider to update us, but instead we query teh provider for the state.

Re: SIM 7.2 event reporting

BuddyD — Mon, 22 Apr 2013 15:00:27 GMT

Thank you for the info. But it still doesn't resolve the issue. If a component is faulty, I would like to receive an email/test message, etc. But without logging, event management is useless. The CMS reports log ins and log outs, but not faulty components?!

Re: SIM 7.2 event reporting

LGentile — Mon, 22 Apr 2013 19:17:32 GMT

So, the assumption is that the 'events' tab is just completely blank, correct?

As mentioned before, i think the message is getting lost somehow. As Tushar said, the health status is updated via a poll to the server, so basically from CMS to client. Events/traps are the other way around, so my guess is that the trap is not getting to the SIM/CMS server. Is there a way for you to scan the network traffic to see if the CMS is "seeing" the trap?

I admit i haven't had to troubleshoot WBEM communication (so far) so I am not sure what else to suggest at this point.

Re: SIM 7.2 event reporting

BuddyD — Mon, 22 Apr 2013 19:44:34 GMT

Not completely blank, but hardware events are not getting reported. Log in and log out, and this past weekend some of the data gathering tasks failed and that was reported.

Scanning the network traffic might be a problem, but I'll investigate that. Question: do the monitored servers need to be "Run Tools" enabled? The 3 Proliants running ESX are not....could that becausing the issue? I've attached another screenshot, please see below.

Thanks again for the advice/assistance.

Re: SIM 7.2 event reporting

BuddyD — Mon, 22 Apr 2013 19:58:59 GMT

I just noticed an item in the user guide. Does the WMI mapper service need to be configured on the ESX hosts? It appears to be a requirement, according to the doc I'm looking at.

Re: SIM 7.2 event reporting

LGentile — Thu, 25 Apr 2013 15:49:25 GMT

I admit i am not sure what screen you are looking at for the tools configuration. Let me know where this is and I can check my ESXi collection. I didn't have to do anything special at all - just throw in the credentials, discover, then subscribe to events.

Re: SIM 7.2 event reporting

BuddyD — Mon, 29 Apr 2013 14:15:41 GMT

Thanks again. As it turned out, the fix was to unsusbscribe to the WBEM events and then re-subscribe. I had only redone the subscribe process, and as it said it was successful, I assumed it was. Apparently not. An HP employee enlightened me.

Many thanks to you and everyone else who offered advice.