Query: Unable to recieve syslog from MSA1060

[Gyokai]

Hi,

I"m having a problem with MSA1060.

I"m trying to let MSA1060 send syslog to a Virtual Machine that running on RHEL8.5 and hosting by VMware vSphere ESXi 7. The Firmware version is IN110P001.

like the screenshot below, I set the IPv4 address where the rsyslogd daemon are. the also checked the "Send Test Syslog Notification" check box. But it's weird that when I click "set syslog" button I can confirm that something is sended to RHEL8 VM, and nothing is writen on the target log file.

btw here's the config syntax.

if $fromhost-ip == '{MSA 1060 IPv4 address}' then {
*.* /app/log/vmware/storage.log
stop
}

Actually the RHEL8 VM got something from MSA1060, I can know that throught tcpdump command. but when I cat the log file, it told me there's no such file. it haven't created. What should I do?

[support_s]

System recommended content:

1. HP Serviceguard for HP-UX - cmgetconf Failed with "Unable to receive device query message from Node: Software caused connection abort"

2. HP ServiceGuard for HP-UX - Unable to Receive Device Query Message from : Software Caused Connection Abort

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[sbhat09]

Hello @Gyokai,

Hope the initial issue in your post is resolved now and the syslog host is receiving the log file.

Now, the cat command can't read the log file may be because that is a test syslog file. Can you ensure that the real syslog file is transferred the syslog server and check again? Also please check the size of the log file so that the log file has some data in it or not.

Regards,
Srinivas Bhat

If you feel this was helpful please click the KUDOS! thumb below!
Note: All of my comments are my own and are not any official representation of the company.

[Gyokai]

Hi  @sbhat09 ,

Actually I'm not sure there's any syslog transmission between MSA1060 and RHEL8.5 VM.

anyway, here's some extra information about how other VMs transfering their syslog to this RHEL 8.5 VM:

22/08/03 13:45:31 # tcpdump src host {MSA1060 IPv4 Address}
22/08/03 13:45:31 dropped privs to tcpdump
22/08/03 13:45:31 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
22/08/03 13:45:35 listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes
22/08/03 13:45:40 13:45:34.215268 IP mytestserver > mytestserver2: ICMP echo reply, id 5347, seq 2327, length 20
22/08/03 13:45:40 13:45:39.341123 ARP, Reply mytestserver is-at 00:c0:ff:64:7e:96 (oui Unknown), length 46
22/08/03 13:46:04 13:45:39.431438 ARP, Request who-has mytestserver2 tell mytestserver, length 46
22/08/03 13:46:04 13:46:03.530717 IP mytestserver.52594 > mytestserver2.snmptrap:  C="testcommunity" Trap(298)  E:hp.2.51 192.168.1.248 enterpriseSpecific s=300
22/08/03 13:46:04 1 7441481 X:94.1.11.1.3.80.12.15.246.62.212.240.0.0.0.0.0.0.0.0.0.10009999=10009999 X:94.1.11.1.7.80.12.15.246.62.212.240.0.0.0.
22/08/03 13:46:04 0.0.0.0.0.0.10009999=3 X:94.1.11.1.9.80.12.15.246.62.212.240.0.0.0.0.0.0.0.0.0.10009999=45_76_65_6e_74_20_74_79_70_65_3a_20_33_3
22/08/03 13:46:04 1_32_2c_20_54_65_73_74_20_53_4e_4d_50_20_74_72_61_70_83_a0_e5_90_8d_76_6d_63_6d_73_74_33_30_e3_80_81_e3_82_bf_e3_82_a4_e3_83_97_
22/08/03 13:46:04 48_50_45_20_4d_53_41_20_31_30_36_30_20_53_41_53_e3_80_81_53_2f_4e_20_41_43_4d_31_32_39_53_31_59_36_e3_80_81_e9_83_a8_e5_93_81_e7
22/08/03 13:46:04 _95_aa_e5_8f_b7_e3_81_8b_e3_82_89_e3_81_ae_e3_83_86_e3_82_b9_e3_83_88_e3_82_a4_e3_83_99_e3_83_b3_e3_83_88_20_50_31_32_39_34_32_2
22/08/03 13:46:47 d_30_30_31
22/08/03 13:46:52 13:46:46.693902 IP mytestserver.snmp > mytestserver2.36465:  C="testcommunity" GetResponse(29)  system.sysUpTime.0=7445797
22/08/03 13:46:53 13:46:51.879972 ARP, Request who-has mytestserver2 tell mytestserver, length 46
22/08/03 13:47:09 13:46:52.045017 ARP, Reply mytestserver is-at 00:c0:ff:64:7e:96 (oui Unknown), length 46
22/08/03 13:47:09 ^C
22/08/03 13:47:09 7 packets captured
22/08/03 13:47:09 19 packets received by filter
22/08/03 13:47:09 0 packets dropped by kernel

I also checked other syslog, 

22/08/03 13:47:21 # cd /app/log/vmware/
22/08/03 13:47:22 # ls
22/08/03 13:47:22 esxi.log  esxi.log-20220731  ilo.log  ilo.log-20220803  vcenter.log  vcenter.log-20220731

yes, there's ESXi syslog, iLO syslog, vCenter Server Appliance syslog, but no MSA1060 syslog. So I"m sure that the syslog server workin good, and the network connection is good, both of them got ping response. 

[Gyokai]

Hi @sbhat09 ,

I think I found what's wrong about syslog setting.

First at all, I think I take this problem in a wrong way. it was not "unable to recieve syslog", it was setting in a wrong parameter. because I actually got some syslog since last time I reply this thread. like this:

Aug  6 09:07:51 vmcmst30 APPSV[1590] System Disk updates are available from the update server.
Aug  7 00:01:02 vmcmst30 APPSV[1590] Degraded System: action required (SN:00C0****ED4F). System Status indicates a degraded system. Failure to take action may result in loss of availability or loss of data. Log into system to determine corrective actions.
Aug  7 00:01:02 vmcmst30 APPSV[1590] System Disk updates are available from the update server.

After last reply I have checked the syslog parameters in CLI. Here's the result of the show command:

# show syslog-parameters
Syslog Parameters
-----------------
Syslog Host: ***.***.***.***
Syslog Notification Level: none
Syslog Host Port: 514
Alert Notification: all
Persistent Alerts: enabled

I don't understand. When I navigate to the syslog setting page in SMU, there's none option to set syslog notification level. So when I enter syslog host ip and port then click apply button, the syslog notification level will set up as "none". So I can't receive the test event message from MSA 1060 by syslog transmission.  I almost believed that there's something wrong beteen the connection of MSA 1060 and RHEL 8.5 VM. 

To make syslog to recieve test event, I did this:

# set syslog-parameters host-ip {the RHEL 8.5 VM ip} host-port 514 notification-level info

  then just as expected, got the test event in syslog file.

Aug 12 10:17:10 vmcmst30 APPSV[1590] Test event from system name vmcmst30, type HPE MSA 1060 SAS, S/N ACM*******, part number P12942-001

But why? why there's none option to set syslog notification level in SMU? if I set this parameter to "info", can I get notification when the storage system is in trouble like disk broken or host mapping error?

Thank you.