Dell PowerVault MD series

PowerVault logs can be sent to a remote Syslog destination via UDP by using the "Event Monitor" Windows service, which is a part of the Modular Disk Storage Manager application used to manage PowerVault. The MD Storage Manager is a separate application which is usually installed on a management server. It connects to the MD unit and provides a convenient graphical interface for managing the PowerVault storage.

Log sample

Date/Time: 4/5/17 2:43:00 PM
Sequence number: 418209
Event type: 4011
Description: Virtual disk not on preferred path due to failover
Event specific codes: 0/0/0
Event category: Error
Component type: RAID Controller Module
Component location: Enclosure 0, Slot 0
Logged by: RAID Controller Module in slot 0

Date/Time: 4/5/17 4:06:21 PM
Sequence number: 418233
Event type: 104
Description: Needs attention condition resolved
Event specific codes: 0/0/0
Event category: Internal
Component type: RAID Controller Module
Component location: Enclosure 0, Slot 0
Logged by: RAID Controller Module in slot 0

For more details about configuring PowerVault alerts and using MD Storage Manager, see Dell Support.

The steps below have been tested with the PowerVault MD3200 Series SAN and should work with any MD unit managed by MD Storage Manager Enterprise.

Configure NXLog for receiving log entries via UDP (see the examples below), then restart NXLog.
Confirm that the NXLog agent is accessible from the server where MD Storage Manager is installed.
Locate the PMServer.properties file. By default, the file can be found in C:\Program Files (x86)\Dell\MD Storage Software\MD Storage Manager\client\data.

Edit the file. Set enable_local_logger to true, specify the Syslog server address, and set the facility.

Example 1. Sending logs to an IP address

With the following directives, the MD Storage Manager will send events to the 192.168.15.223 IP address via UDP port 514.

PMServer.properties

Time_format(12/24)=12
syslog_facilty=3
DBM_files_maximum_key=20
DBM_files_minimum_key=5
syslog_receivers=192.168.15.223
DBM_recovery_interval_key=120
DBM_recovery_debounce_key=5
DBM_files_maintain_timeperiod_key=14
eventlog_source_name=StorageArray
enable_local_logger=true
syslog_tag=StorageArray

Restart the Event Monitor service to apply the changes.

Example 2. Receiving Syslog messages from the MD Storage Manager

This example shows PowerVault logs as received and processed by NXLog with the im_udp and xm_syslog modules.

nxlog.conf

<Extension _syslog>
    Module  xm_syslog
</Extension>

<Extension _json>
    Module  xm_json
</Extension>

<Input in_syslog_udp>
    Module  im_udp
    Host    0.0.0.0
    Port    514
    Exec    parse_syslog();
</Input>

<Output file>
    Module  om_file
    File    "/var/log/mdsan.log"
    Exec    to_json();
</Output>

Output sample

{
  "MessageSourceAddress": "192.168.15.231",
  "EventReceivedTime": "2017-04-05 14:43:45",
  "SourceModuleName": "in_syslog_udp",
  "SourceModuleType": "im_udp",
  "SyslogFacilityValue": 3,
  "SyslogFacility": "DAEMON",
  "SyslogSeverityValue": 4,
  "SyslogSeverity": "WARNING",
  "SeverityValue": 3,
  "Severity": "WARNING",
  "Hostname": "192.168.5.18",
  "EventTime": "2017-04-05 14:43:00",
  "SourceName": "StorageArray",
  "Message": "MD3620f1;4011;Warning;Virtual disk not on preferred path due to failover"
}
{
  "MessageSourceAddress": "192.168.15.231",
  "EventReceivedTime": "2017-04-05 16:07:01",
  "SourceModuleName": "in_syslog_udp",
  "SourceModuleType": "im_udp",
  "SyslogFacilityValue": 3,
  "SyslogFacility": "DAEMON",
  "SyslogSeverityValue": 6,
  "SyslogSeverity": "INFO",
  "SeverityValue": 2,
  "Severity": "INFO",
  "Hostname": "192.168.5.18",
  "EventTime": "2017-04-05 16:06:21",
  "SourceName": "StorageArray",
  "Message": "MD3620f1;104;Informational;Needs attention condition resolved"
}

Example 3. Extracting additional fields

The following configuration uses a regular expression to extract additional fields from each message.

nxlog.conf

<Input in_syslog_udp>
    Module  im_udp
    Host    0.0.0.0
    Port    514
    <Exec>
        parse_syslog();
        if $Message =~ /^([a-zA-Z0-9]*);([0-9]*);([a-zA-Z]*);(.*)$/
        {
            $MDArray = $1;
            $MDMsgID = $2;
            $MDMsgLevel = $3;
            $MDMessage = $4;
        }
    </Exec>
</Input>

Output sample

{
  "MessageSourceAddress": "192.168.15.231",
  "EventReceivedTime": "2017-04-05 14:43:45",
  "SourceModuleName": "in_syslog_udp",
  "SourceModuleType": "im_udp",
  "SyslogFacilityValue": 3,
  "SyslogFacility": "DAEMON",
  "SyslogSeverityValue": 4,
  "SyslogSeverity": "WARNING",
  "SeverityValue": 3,
  "Severity": "WARNING",
  "Hostname": "192.168.5.18",
  "EventTime": "2017-04-05 14:43:00",
  "SourceName": "StorageArray",
  "Message": "MD3620f1;4011;Warning;Virtual disk not on preferred path due to failover",
  "MDArray": "MD3620f1",
  "MDMsgID": "4011",
  "MDMsgLevel": "Warning",
  "MDMessage": "Virtual disk not on preferred path due to failover"
}

Disclaimer

While we endeavor to keep the information in this topic up to date and correct, NXLog makes no representations or warranties of any kind, express or implied about the completeness, accuracy, reliability, suitability, or availability of the content represented here. We update our screenshots and instructions on a best-effort basis.

Last revision: 03 June 2019