HP MSA 1040 HP MSA 1040 SMU Reference Guide (762784-001, March 2014) - Page 175

D Administering a log-collection system A log-collection system receives log data that is incrementally transferred from a storage system whose managed logs feature is enabled, and is used to integrate that data for display and analysis. For information about the managed logs feature, see "About managed logs" (page 31). Over time, a log-collection system can receive many log files from one or more storage systems. The administrator organizes and stores these log files on the log-collection system. Then, if a storage system experiences a problem that needs analysis, that system's current log data can be collected and combined with the stored historical log data to provide a long-term view of the system's operation for analysis. The managed logs feature monitors the following controller-specific log files: • Expander Controller (EC) log, which includes EC debug data, EC revisions, and PHY statistics • Storage Controller (SC) debug log and controller event log • SC crash logs, which include the SC boot log • Management Controller (MC) log Each log-file type also contains system-configuration information. How log files are transferred and identified Log files can be transferred to the log-collection system in two ways, depending on whether the managed logs feature is configured to operate in push mode or pull mode: • In push mode, when log data has accumulated to a significant size, the storage system sends notification events with attached log files through email to the log-collection system. The notification specifies the storage-system name, location, contact, and IP address, and contains a single log segment in a compressed zip file. The log segment will be uniquely named to indicate the log-file type, the date/time of creation, and the storage system. This information will also be in the email subject line. The file name format is logtype_yyyy_mm_dd__hh_mm_ss.zip. • In pull mode, when log data has accumulated to a significant size, the system sends notification events via email, SNMP traps, or SMI-S to the log-collection system. The notification will specify the storage-system name, location, contact, and IP address and the log-file type (region) that needs to be transferred. The storage system's FTP interface can be used to transfer the appropriate logs to the log-collection system, as described in "Transferring log data to a log-collection system" (page 158). Log-file details • SC debug-log records contain date/time stamps of the form mm/dd hh:mm:ss. • SC crash logs (diagnostic dumps) are produced if the firmware fails. Upon restart, such logs are available, and the restart boot log is also included. The four most recent crash logs are retained in the storage system. • When EC debug logs are obtained, EC revision data and SAS PHY statistics are also provided. • MC debug logs transferred by the managed logs feature are for five internal components: appsv, mccli, logc, web, and snmpd. The contained files are log-file segments for these internal components and are numbered sequentially. How log files are transferred and identified 175