Integrity Servers
cancel
Showing results for 
Search instead for 
Did you mean: 

EMS When is a MAJOR_WARNING not a MAJOR_WARNING

 
SOLVED
Go to solution
Andrew Young_2
Honored Contributor

EMS When is a MAJOR_WARNING not a MAJOR_WARNING

Hi

We have EMS 4.20 installed on all our servers together with ISEE A.03.95.057.

Last Sunday we had an incident where ISEE phoned home with a CPU cache error on one of our rx7640's. The problem was that EMS didn't notify us of this. The incident is logged as MAJOR_WARNING in the EMS log file and I have checked the EMS configuration where MAJOR_WARNINGS should be written to the syslog and emails sent. This is configured correctly. However neither of these things happenned.

Does anyone know of any additional criteria that can affect the decision on the severity of the call or is this an EMS error (bug) of some sort?

Additional info:
EMS text logging is set the INFORMATION level.
EMS configured using etc/opt/resmon/lbin/monconfig

Regards

Andrew Y
Si hoc legere scis, nimis eruditionis habes
9 REPLIES 9
tkc
Esteemed Contributor

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

hi andrew,

check your config in ems if there is notification if event => 4 (major warning). see http://docs.hp.com/en/5991-6760/ch03s03.html#bajdfcaj
Andrew Young_2
Honored Contributor

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

Of course:

The current monitor configuration is:
1) Send events generated by all monitors
with severity >= MAJOR WARNING to SYSLOG
2) Send events generated by all monitors
with severity >= INFORMATION to TEXTLOG /var/opt/resmon/log/event.log
3) Send events generated by all monitors
with severity >= MAJOR WARNING to EMAIL root
Si hoc legere scis, nimis eruditionis habes
tkc
Esteemed Contributor

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

hi andrew,

i mean check the criteria for individual event. it could have overwritten the criteria for all events. what event did you get for this? you can see the event inside the file /var/opt/resmon/log/event.log
Andrew Young_2
Honored Contributor

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

Hi.

I assume your are referring to this:

>/system/events/cpu/cmc ... OK.
For /system/events/cpu/cmc/cache_errors:
Events >= 1 (INFORMATION) Goto TEXTLOG; file=/var/opt/resmon/log/event.log
Events >= 3 (MAJOR WARNING) Goto SYSLOG
Events >= 3 (MAJOR WARNING) Goto EMAIL; addr=root
Events >= 1 (INFORMATION) Goto TEXTLOG; file=/var/opt/resmon/log/rst.log
Client Configuration File: /var/stm/config/tools/monitor/rst_cmc_em.clcfg
Events >= 1 (INFORMATION) Goto TCP; host=localhost port=1402
Comment: RST Request
Client Configuration File: /var/stm/config/tools/monitor/rst_cmc_em.clcfg
Events >= ?? Goto TCP; host=localhost port=49176
Client Configuration File: /var/stm/config/tools/monitor/wbem_cmc_em.clcfg

There is no entry in :
/var/opt/resmon/log/event.log
But there is in:
Event data from monitor: /var/opt/resmon/log/rst.log

Event Time..........: Sun Aug 19 23:09:15 2007
Severity............: MAJORWARNING
Monitor.............: cmc_em
Event #.............: 100642
System..............: sovprod1.sovint.co.za


Regards

Andrew Y
Si hoc legere scis, nimis eruditionis habes
tkc
Esteemed Contributor

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

I didn't see the following :

Events >= 3 (MAJORWARNING) Goto TEXTLOG; file=/var/opt/resmon/log/event.log

So I believe, that's why it's not captured in the event.log file. As for the syslog, it should be captured. What is the oldest date in the syslog.log file? Have you also checked the OLDsyslog.log file? As for the mail notification,

Events >= 3 (MAJOR WARNING) Goto EMAIL; addr=root

Did you check the mail for root account?
Andrew Young_2
Honored Contributor

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

Hi.

But there is the following:

Events >= 1 (INFORMATION) Goto TEXTLOG; file=/var/opt/resmon/log/event.log
which should cover it.

But since this wasn't working either perhaps there is an error in the config.

There was no mail sent to root either. The only entry is in the rst.log file.

Regards

Andrew Y
Si hoc legere scis, nimis eruditionis habes
Sameer_Nirmal
Honored Contributor

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

Looks like the event is detected/reported by ISEE. I see the release notes of ISEE A.03.95.500 at http://isee.americas.hp.com/isee/Releases/isee.A.03.95.500.standard.html where the issue is fixed which was reported as
"JAGaf78710 cmc_em event 100642 generates 'major warning' for sin"

You might want to update ISEE to latest version.
tkc
Esteemed Contributor

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

I am more incline to believe that this could be an issue with EMS. Could you check the version of the diagnostic? There are patches for the fixes in every EMS/STM release.
Andrew Merritt_2
Honored Contributor
Solution

Re: EMS When is a MAJOR_WARNING not a MAJOR_WARNING

Sameer is correct, it's a problem with ISEE; install the current version.

You should also ensure that the OnlineDiags are up-to-date, but that's not the cause of the problem.

Andrew