Dell PowerVault MD series
PowerVault logs can be sent to a remote Syslog destination via UDP by using the "Event Monitor" Windows service, which is a part of the Modular Disk Storage Manager application used to manage PowerVault. The MD Storage Manager is a separate application that is usually installed on a management server. It connects to the MD unit and provides a convenient graphical interface for managing the PowerVault storage.
Date/Time: 4/5/17 2:43:00 PM
Sequence number: 418209
Event type: 4011
Description: Virtual disk not on preferred path due to failover
Event specific codes: 0/0/0
Event category: Error
Component type: RAID Controller Module
Component location: Enclosure 0, Slot 0
Logged by: RAID Controller Module in slot 0
Date/Time: 4/5/17 4:06:21 PM
Sequence number: 418233
Event type: 104
Description: Needs attention condition resolved
Event specific codes: 0/0/0
Event category: Internal
Component type: RAID Controller Module
Component location: Enclosure 0, Slot 0
Logged by: RAID Controller Module in slot 0
For more details about configuring PowerVault alerts and using MD Storage Manager, see Dell Support.
The steps below have been tested with the PowerVault MD3200 Series SAN and should work with any MD unit managed by MD Storage Manager Enterprise. |
-
Configure NXLog Agent for receiving log entries via UDP (see the examples below), then restart NXLog Agent.
-
Confirm that NXLog Agent is accessible from the server where MD Storage Manager is installed.
-
Locate the PMServer.properties file. By default, the file can be found in
C:\Program Files (x86)\Dell\MD Storage Software\MD Storage Manager\client\data
. -
Edit the file. Set
enable_local_logger
totrue
, specify the Syslog server address, and set the facility.Example 1. Sending logs to an IP addressWith the following directives, the MD Storage Manager will send events to the 192.168.15.223 IP address via UDP port 514.
PMServer.propertiesTime_format(12/24)=12 syslog_facilty=3 DBM_files_maximum_key=20 DBM_files_minimum_key=5 syslog_receivers=192.168.15.223 DBM_recovery_interval_key=120 DBM_recovery_debounce_key=5 DBM_files_maintain_timeperiod_key=14 eventlog_source_name=StorageArray enable_local_logger=true syslog_tag=StorageArray
-
Restart the Event Monitor service to apply the changes.
This example shows PowerVault logs as received and processed by NXLog Agent with the im_udp and xm_syslog modules.
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension _json>
Module xm_json
</Extension>
<Input in_syslog_udp>
Module im_udp
Host 0.0.0.0
Port 514
Exec parse_syslog();
</Input>
<Output file>
Module om_file
File "/var/log/mdsan.log"
Exec to_json();
</Output>
{
"MessageSourceAddress": "192.168.15.231",
"EventReceivedTime": "2017-04-05 14:43:45",
"SourceModuleName": "in_syslog_udp",
"SourceModuleType": "im_udp",
"SyslogFacilityValue": 3,
"SyslogFacility": "DAEMON",
"SyslogSeverityValue": 4,
"SyslogSeverity": "WARNING",
"SeverityValue": 3,
"Severity": "WARNING",
"Hostname": "192.168.5.18",
"EventTime": "2017-04-05 14:43:00",
"SourceName": "StorageArray",
"Message": "MD3620f1;4011;Warning;Virtual disk not on preferred path due to failover"
}
{
"MessageSourceAddress": "192.168.15.231",
"EventReceivedTime": "2017-04-05 16:07:01",
"SourceModuleName": "in_syslog_udp",
"SourceModuleType": "im_udp",
"SyslogFacilityValue": 3,
"SyslogFacility": "DAEMON",
"SyslogSeverityValue": 6,
"SyslogSeverity": "INFO",
"SeverityValue": 2,
"Severity": "INFO",
"Hostname": "192.168.5.18",
"EventTime": "2017-04-05 16:06:21",
"SourceName": "StorageArray",
"Message": "MD3620f1;104;Informational;Needs attention condition resolved"
}
The following configuration uses a regular expression to extract additional fields from each message.
<Input in_syslog_udp>
Module im_udp
Host 0.0.0.0
Port 514
<Exec>
parse_syslog();
if $Message =~ /^([a-zA-Z0-9]*);([0-9]*);([a-zA-Z]*);(.*)$/
{
$MDArray = $1;
$MDMsgID = $2;
$MDMsgLevel = $3;
$MDMessage = $4;
}
</Exec>
</Input>
{
"MessageSourceAddress": "192.168.15.231",
"EventReceivedTime": "2017-04-05 14:43:45",
"SourceModuleName": "in_syslog_udp",
"SourceModuleType": "im_udp",
"SyslogFacilityValue": 3,
"SyslogFacility": "DAEMON",
"SyslogSeverityValue": 4,
"SyslogSeverity": "WARNING",
"SeverityValue": 3,
"Severity": "WARNING",
"Hostname": "192.168.5.18",
"EventTime": "2017-04-05 14:43:00",
"SourceName": "StorageArray",
"Message": "MD3620f1;4011;Warning;Virtual disk not on preferred path due to failover",
"MDArray": "MD3620f1",
"MDMsgID": "4011",
"MDMsgLevel": "Warning",
"MDMessage": "Virtual disk not on preferred path due to failover"
}