Lacie 131018 User Manual - Page 41

Syslog

Page 41 highlights

Getting Started 4.5 SYSLOG StorView's SYSLOG agent is a module designed for StorView that enables sending RAID system event logs to all listening SYSLOG clients on all installed platforms. SYSLOG requires that the Global Access license be enabled before the feature is activated. Once activated on each installation of StorView, the locally monitored storage system events are then sent to the SYSLOG daemon running on the host system. StorView SYSLOG is designed for greater flexibility in that it supports "many-to-many" mapping. You may have: • Multiple SYSLOG servers that monitor a single RAID storage system for event logs. • A single SYSLOG server that monitors multiple RAID storage systems for event logs. • Multiple SYSLOG servers that monitor multiple RAID storage systems for event logs. This "many-to-many" mapping provides an additional safety net in that it offers data redundancy. In this instance a failed SYSLOG server will not have any impact if another SYSLOG server is functioning normally. If you are using a Linux operating system, the syslogd daemon is a component of your operating system. If you are using a Windows operating system you will need to install a separate tool (http://syslogwin32.sourceforge.net/) which runs as a Windows service. 4.5.1 Gathering Logs A host based StorView running the SYSLOG agent with two in-band connections to RAID storage systems, each with a unique WWN ID. Assuming the SYSLOG is configured to log/dispatch Error type events, It will gather all Error type events for both RAID storage systems and sent them directly to the intended host. The StorView SYSLOG agent is global in scope, in that it will always receive all error logs from the accessible storage systems. It is not possible to customize filtering of events for each managed storage system for that host. With Embedded StorView, previously configured listening SYSLOG servers will persist even though the embedded module is flashed with new software as the file data is stored in NVRAM and is not affected by software upgrades. However, with instances of installed host-based StorView, you must backup or make a copy of the syslog.ini file otherwise software updates will destroy the configuration information. 4.5.2 SYSLOG Daemon The daemon listens for incoming event log messages on port 514. It logs them to a messages file. The SYSLOG messages consist of: • Facility - indicates the type of syslog message. For example they can be kernel, user level, mail system and system daemon messages. • Priority - indicates the sensitivity of the message, to include: Information, Warning, or Error. • Timestamp - indicates the date and time of the event. 33

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214

Getting Started
33
4.5 SYSLOG
StorView’s SYSLOG agent is a module designed for StorView that enables sending RAID system event
logs to all listening SYSLOG clients on all installed platforms.
SYSLOG requires that the Global Access license be enabled before the feature is activated. Once
activated on each installation of StorView, the locally monitored storage system events are then sent to
the SYSLOG daemon running on the host system.
StorView SYSLOG is designed for greater flexibility in that it supports “many-to-many” mapping. You may
have:
Multiple SYSLOG servers that monitor a single RAID storage system for event logs.
A single SYSLOG server that monitors multiple RAID storage systems for event logs.
Multiple SYSLOG servers that monitor multiple RAID storage systems for event logs.
This “many-to-many” mapping provides an additional safety net in that it offers data redundancy. In this
instance a failed SYSLOG server will not have any impact if another SYSLOG server is functioning
normally.
If you are using a Linux operating system, the syslogd daemon is a component of your operating system.
If you are using a Windows operating system you will need to install a separate tool (http://syslog-
win32.sourceforge.net/) which runs as a Windows service.
4.5.1
Gathering Logs
A host based StorView running the SYSLOG agent with two in-band connections to RAID storage
systems, each with a unique WWN ID. Assuming the SYSLOG is configured to log/dispatch Error type
events, It will gather all Error type events for both RAID storage systems and sent them directly to the
intended host.
The StorView SYSLOG agent is global in scope, in that it will always receive all error logs from the
accessible storage systems. It is not possible to customize filtering of events for each managed storage
system for that host.
With Embedded StorView, previously configured listening SYSLOG servers will persist even though the
embedded module is flashed with new software as the file data is stored in NVRAM and is not affected
by software upgrades.
However, with instances of installed host-based StorView, you must backup or make a copy of the
syslog.ini file otherwise software updates will destroy the configuration information.
4.5.2
SYSLOG Daemon
The daemon listens for incoming event log messages on port 514. It logs them to a messages file. The
SYSLOG messages consist of:
Facility - indicates the type of syslog message. For example they can be kernel, user level, mail
system and system daemon messages.
Priority - indicates the sensitivity of the message, to include: Information, Warning, or Error.
Timestamp - indicates the date and time of the event.