NXLog User Guide

55. Dell PowerVault MD Series

PowerVault MD logs can be sent to a remote Syslog destination via UDP by using the "Event Monitor" Windows service, which is a part of the Modular Disk Storage Manager application used to manage PowerVault. The MD Storage Manager is a separate application which is usually installed on a management server. It connects to the MD unit and provides a convenient graphical interface for managing the PowerVault storage.

Log Sample

Date/Time: 4/5/17 2:43:00 PM
Sequence number: 418209
Event type: 4011
Description: Virtual disk not on preferred path due to failover
Event specific codes: 0/0/0
Event category: Error
Component type: RAID Controller Module
Component location: Enclosure 0, Slot 0
Logged by: RAID Controller Module in slot 0

Date/Time: 4/5/17 4:06:21 PM
Sequence number: 418233
Event type: 104
Description: Needs attention condition resolved
Event specific codes: 0/0/0
Event category: Internal
Component type: RAID Controller Module
Component location: Enclosure 0, Slot 0
Logged by: RAID Controller Module in slot 0

For more details about configuring PowerVault alerts and using MD Storage Manager, see Dell Support.

Note	The steps below have been tested with the PowerVault MD3200 Series SAN and should work with any MD unit managed by MD Storage Manager Enterprise.

Configure NXLog for receiving log entries via UDP (see the examples below), then restart NXLog.
Confirm that the NXLog agent is accessible from the server where MD Storage Manager is installed.
Locate the PMServer.properties file. By default, the file can be found in C:\Program Files (x86)\Dell\MD Storage Software\MD Storage Manager\client\data.

Edit the file. Set enable_local_logger to true, specify the Syslog server address, and set the facility.

Example 226. Sending Logs to 192.168.15.223

With the following directives, the MD Storage Manager will send events to 192.168.15.223 via UDP port 514.

PMServer.properties

Time_format(12/24)=12
syslog_facilty=3
DBM_files_maximum_key=20
DBM_files_minimum_key=5
syslog_receivers=192.168.15.223
DBM_recovery_interval_key=120
DBM_recovery_debounce_key=5
DBM_files_maintain_timeperiod_key=14
eventlog_source_name=StorageArray
enable_local_logger=true
syslog_tag=StorageArray

Restart the Event Monitor service to apply the changes.

Example 227. Receiving Syslog Messages From the MD Storage Manager

This example shows PowerVault logs as received and processed by NXLog with the im_udp and xm_syslog modules.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

  <Extension _syslog>
    Module  xm_syslog
</Extension>

<Extension _json>
    Module  xm_json
</Extension>

<Input in_syslog_udp>
    Module  im_udp
    Host    0.0.0.0
    Port    514
    Exec    parse_syslog();
</Input>

<Output file>
    Module  om_file
    File    "/var/log/mdsan.log"
    Exec    to_json();
</Output>

Output Sample

{
  "MessageSourceAddress": "192.168.15.231",
  "EventReceivedTime": "2017-04-05 14:43:45",
  "SourceModuleName": "in_syslog_udp",
  "SourceModuleType": "im_udp",
  "SyslogFacilityValue": 3,
  "SyslogFacility": "DAEMON",
  "SyslogSeverityValue": 4,
  "SyslogSeverity": "WARNING",
  "SeverityValue": 3,
  "Severity": "WARNING",
  "Hostname": "192.168.5.18",
  "EventTime": "2017-04-05 14:43:00",
  "SourceName": "StorageArray",
  "Message": "MD3620f1;4011;Warning;Virtual disk not on preferred path due to failover"
}
{
  "MessageSourceAddress": "192.168.15.231",
  "EventReceivedTime": "2017-04-05 16:07:01",
  "SourceModuleName": "in_syslog_udp",
  "SourceModuleType": "im_udp",
  "SyslogFacilityValue": 3,
  "SyslogFacility": "DAEMON",
  "SyslogSeverityValue": 6,
  "SyslogSeverity": "INFO",
  "SeverityValue": 2,
  "Severity": "INFO",
  "Hostname": "192.168.5.18",
  "EventTime": "2017-04-05 16:06:21",
  "SourceName": "StorageArray",
  "Message": "MD3620f1;104;Informational;Needs attention condition resolved"
}

Example 228. Extracting Additional Fields

The following configuration uses a regular expression to extract additional fields from each message.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

  <Input in_syslog_udp>
    Module  im_udp
    Host    0.0.0.0
    Port    514
    <Exec>
        parse_syslog();
        if $Message =~ /^([a-zA-Z0-9]*);([0-9]*);([a-zA-Z]*);(.*)$/
        {
            $MDArray = $1;
            $MDMsgID = $2;
            $MDMsgLevel = $3;
            $MDMessage = $4;
        }
    </Exec>
</Input>

Output Sample

{
  "MessageSourceAddress": "192.168.15.231",
  "EventReceivedTime": "2017-04-05 14:43:45",
  "SourceModuleName": "in_syslog_udp",
  "SourceModuleType": "im_udp",
  "SyslogFacilityValue": 3,
  "SyslogFacility": "DAEMON",
  "SyslogSeverityValue": 4,
  "SyslogSeverity": "WARNING",
  "SeverityValue": 3,
  "Severity": "WARNING",
  "Hostname": "192.168.5.18",
  "EventTime": "2017-04-05 14:43:00",
  "SourceName": "StorageArray",
  "Message": "MD3620f1;4011;Warning;Virtual disk not on preferred path due to failover",
  "MDArray": "MD3620f1",
  "MDMsgID": "4011",
  "MDMsgLevel": "Warning",
  "MDMessage": "Virtual disk not on preferred path due to failover"
}