ProLiant Servers (ML,DL,SL)
cancel
Showing results for 
Search instead for 
Did you mean: 

Reading and erasing iLO logs without losing events between operations

fcolombo
Occasional Visitor

Reading and erasing iLO logs without losing events between operations

I need to record iLO logs (such as server resets, power failures or invalid logins) into Windows Events. I developed a program that captures ouput of the following:

 

  hponcfg.exe /f get_ilo_log.xml

 

Where get_ilo_log.xml is defined as:

 

<RIBCL version="2.21">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="READ" >
<GET_EVENT_LOG />
</RIB_INFO>
</LOGIN>
</RIBCL>

 

After this, the program calls hponcfg.exe again, in order to erase logs with the following script:

 

<RIBCL VERSION="2.0">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="write">
<CLEAR_EVENTLOG/>
</RIB_INFO>
</LOGIN>
</RIBCL>

 

The problem is that we lose all iLO events happening in the time between reading the logs and erasing them. This is particularly bad during a Denial of Service atack, where we cannot lose any iLO event.

 

So I need a way to safely erase iLO logs without losing anything. It would be nice if I could either query or erase only logs from a date range or other filter.

3 REPLIES
Casper42
Trusted Contributor

Re: Reading and erasing iLO logs without losing events between operations

Not sure if this will work, but why not combine your scripts.

<RIBCL version="2.21">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="READ" >
<GET_EVENT_LOG />
<CLEAR_EVENTLOG/>
</RIB_INFO>
</LOGIN>
</RIBCL>

This way the Read and Erase are run as close together as possible.
fcolombo
Occasional Visitor

Re: Reading and erasing iLO logs without losing events between operations

Thanks, but I guess it's not enough. This reduces window of lost events, but does not prevent them.

Highlighted
Jimmy Vance
HPE Pro

Re: Reading and erasing iLO logs without losing events between operations

You might try something like this

 

<RIBCL version="2.21">

<LOGIN USER_LOGIN="adminname" PASSWORD="password">

 

<RIB_INFO MODE="READ" >

   <GET_EVENT_LOG />

</RIB_INFO>

 

<RIB_INFO MODE="write">

  <CLEAR_EVENTLOG/>

</RIB_INFO>

 

</LOGIN>

</RIBCL>




__________________________________________________
No support by private messages. Please ask the forum!      I work for HPE

If you feel this was helpful please click the KUDOS! thumb below!