3par remote syslog Message Severity

[nsnidanko]

We forward all syslogs to remote server. 3PAR 3.1.3 MU2 seems to have a bug where it classifies the following message as Critical.

3PAR_###### cli_command es_vss_4_windows VSS Snapshot creation success

Is there a way to chage Message Severity behaviour for certain logs?

[Prakash Singh_1]

HI,

PF the attached message syslog settings

[Dennis Handly]

Based on what  Prakash Singh_1 attached, can you find the command in showeventlog that is being sent?

[nsnidanko]

Hi Prakash,

Thank you, I've remote syslog configured already.

Hi Dennis,

Yes, I was able to track it in the showeventlog

Time     : 2015-02-24 07:32:50 EST
Severity : Informational
Type     : CLI command executed
Message  : {3parrm edit all {{0 4}} -1 10.*.*.100 8613} {userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}} {}

As you can see 3par forwards it with "Major" severity .

[Dennis Handly]

>I was able to track it in the showeventlog

This was the command that created the event.  There should be the real event with major close by.

It seems this was created by some recovery manager: 3parrm

[nsnidanko]

Yes, you're correct. This account is used by 3PAR Recovery Manager for SQL, which takes snapshots every hour and replicates it to second array.

There is an event with major, generated by command above. Here's what it looks like:

Time : 2015-04-02 07:33:19 EDT
Severity : Informational
Type : Notification
Message : Start snap vss0001**7_rw_040******242 (id=6815) from parent vss0001**7_ro_0402******42 (id=6813) on nodes 0x03

Time : 2015-04-02 07:33:19 EDT

Severity : Informational
Type : CLI command executed
Message : {3parrm edit all {{0 4}} -1 10.*.*.50 30035} {userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}} {}

Time : 2015-04-02 07:33:19 EDT
Severity : Major
Type : CLI command executed
Message : VSS Snapshot creation success

I am following you now; Recovery Manager software has a bug because it's issuing this command:

userevent -type command -severity major -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}

It should be:

userevent -type command -severity informational -class notify -component es_vss_4_windows -comp_name VSS {VSS Snapshot creation success}

I will open ticket with HP and notify about this bug.

[Dennis Handly]

>It should be: userevent -type command -severity informational 

Or at least not major.