SIM 7.2 event reporting

[BuddyD]

Hi folks,

I can't seem to get the CMS to update the event log. If I "disable" a redundant power supply on a HP DL380 G7 I see the minor notification in the System Status box, as well as in the HS column next to the affected server. However, nothing gets logged to the Events summary so needless to say, no email/pager alert is received. It is reporting log in and log out events, as well as non-pingable systems.

What did I miss??!

Thanks in advance.

BuddyD

[BPE]

By default there is no email from such events.  You need to check your Event handling Tasks. To see what kind of event will send you an email or log to the event log.

[BuddyD]

Thanks for the response, but no matter what I do, the event never gets reported to the event log and that's the problem. I'm getting emails when I log in or log out because THAT gets reported to the event log. But major, minor hardware events do not. So I guess my question is, where is this controlled?

Yes, I'm new to SIM so...please excuse my lack of knowledge re: the product.

Thanks again.

[J_N_Rhodes]

BuddyD

Enable E-mail Notifications in HP SIM

Carry out the following:

Options > Events > Automatic event handling > E-mail Setings

and input your SMTP Server details etc. You will notice on this screen there is only the option to send a test e-mail.

To set up the event notification:

Options > Events > Automatic event handling > New task

you can now go through the wizard and define which systems, which events, e-mail recipients etc.

If my post was useful, please clik on "White Star" to award me kudos :)

[BuddyD]

Thanks for the response, J-N.  I can successfully send myself test email, this has worked without issue right along. To your second recommendation for setting up event notifications: I've created an all events, all systems, send email and write to system log event handler and saved it.

When I pull the plug on one of my DL380 G7 ESXi servers, I observe the "minor" icon in system status in SIM increment to 1, alerting me to a problem. If I then go to all systems, I see the "minor" icon displayed in the HS column of the affected server. If I then click on Events, and under View "all events", there is no indication/report of a "minor" problem. The only "events" being reported/logged by the CMS seems to be "informational", "critical" or "normal". "Major", "Minor" and "Warning" are not being logged/reported and this is the whole problem.

Is this a "bug/feature" or have I missed something obvious??! Has anyone else run into this and been able to get it resolved?

Again, thanks for the response, J_N.

[LGentile]

You didn't mention ESXi until now.  This may be due to needing to subscribe to WBEM events.

Select your ESXi host, go to Options - Events - Subscribe to WBEM events and run the task.  Perform the PSU test again and see if the event appears.

For ESXi, SNMP is not adequate, it requires you to subscribe to WBEM events so SIM will accept them.  You can even create an event handler to auto-subscribe when new ESXi hosts are added to a specific collection.  This is what i've done.

[BuddyD]

Thanks LGentile. I have done this over the past week or so with no luck. As you mention, my research showed that I needed to use WBEM and not SNMP and I have subscribed a number of times with the same result.

I will run through it one more time, but it seems to me if the ESXi events show up on the CMS (Win) host, it's not a communication issue and WBEM is operating as it should. Again, why is SIM failing to report/log events such as I've mentioned before. I was hoping this would be the easy piece, HP hardware talking to HP software....

Thanks again for the response/help, I'll update if anything changes.

[Tushar Bajpai]

Health Status gets updated based on Hardware status polling and AOE ( Action On Event) Email / Event log is triggered when an trap / Indication is encourted by the CMS.

Please verify if there is any Trap / Indication that got logged.

From the description it looks like CMS didn't recieved any thing and so no AOE.

[BuddyD]

Thank you, Tushar.

Where/how does the System and Health status get separated from the Event logging? WBEM is updating the first two, why doesn't the CMS log the event and/or where is this controlled? I am unable to find it in any menu/pull down.

[LGentile]

I haven't encountered this issue before. Normally once I can see health status and subscribe to events, the notifications/events come in OK.

You may need to resort to a packet sniffing tool like Wireshark to see if your CMS is actually getting the messages. Unfortunately, for WBEM I am not aware of a way to intercept the messages with another tool. If it were SNMP you can set up the SNMP trap service (assuming your CMS is Windows), but in this case that wouldn't help you.

You said something strange earlier.. so you ARE getting Minor events, just not major/critical? A power supply removal is 'Major' or 'Critical' i believe. Can you paste the event text here? What I am asking is - is the PSU removal event actually showing up, but only as a minor event? Just for clarification...

[BuddyD]

Yes, it's showing up as a minor event. We simply pull the plug and it reports as being minor, but the event never gets logged. I'll post the actual results if/when I have a chance to remove the power again.

[BuddyD]

Another view of the "event". As stated previously, no logging is taking place for this.

[Tushar Bajpai]

Traps and Indications which gets logged as System Events and get reflected as aggregated status of the event or overall status of the node. This is dependent on provider or the agent on the target node to update the CMS.

But in case of Heath status CMS goes and checks the node for memory, power, network etc and the same is reflected on the system page as real time data. In this case we are not depedent on the provider to update us, but instead we query teh provider for the state.

[BuddyD]

Thank you for the info. But it still doesn't resolve the issue. If a component is faulty, I would like to receive an email/test message, etc. But without logging, event management is useless. The CMS reports log ins and log outs, but not faulty components?!

[LGentile]

So, the assumption is that the 'events' tab is just completely blank, correct?

As mentioned before, i think the message is getting lost somehow. As Tushar said, the health status is updated via a poll to the server, so basically from CMS to client. Events/traps are the other way around, so my guess is that the trap is not getting to the SIM/CMS server. Is there a way for you to scan the network traffic to see if the CMS is "seeing" the trap?

I admit i haven't had to troubleshoot WBEM communication (so far) so I am not sure what else to suggest at this point.

[BuddyD]

Not completely blank, but hardware events are not getting reported. Log in and log out, and this past weekend some of the data gathering tasks failed and that was reported.

Scanning the network traffic might be a problem, but I'll investigate that. Question: do the monitored servers need to be "Run Tools" enabled? The 3 Proliants running ESX are not....could that becausing the issue? I've attached another screenshot, please see below.

Thanks again for the advice/assistance.

[BuddyD]

I just noticed an item in the user guide. Does the WMI mapper service need to be configured on the ESX hosts? It appears to be a requirement, according to the doc I'm looking at.

[LGentile]

I admit i am not sure what screen you are looking at for the tools configuration.  Let me know where this is and I can check my ESXi collection.  I didn't have to do anything special at all - just throw in the credentials, discover, then subscribe to events.

[BuddyD]

Thanks again. As it turned out, the fix was to unsusbscribe to the WBEM events and then re-subscribe. I had only redone the subscribe process, and as it said it was successful, I assumed it was. Apparently not. An HP employee enlightened me.

Many thanks to you and everyone else who offered advice.

[LGentile]

Thanks for letting us know.. did the HP tech mention a way to tell if the subscribe failed (I assume your tasks always said they completed, yet the events were not working).  I usually run the task and if it completes, I don't check again.. i'm concerned that now I need to be auditing/looking more closely.  I have a task that auto-runs when a server is added to the ESXi collection I created.

Thanks

[BuddyD]

Apologies for the delayed reply...No, the HP tech did NOT mention a way to do that. And yes, just adding did tell me it was successful (even though it was not).