Skip to main content
Hitachi Vantara Knowledge

Understanding the HCP system log

While the Overview page in the System Management Console gives you a view of the system as a whole, the HCP system log lets you monitor system activity on a more detailed level. The log records system events such as:

  • Nodes and services starting
  • Changes to the system configuration
  • Logical volume failures
  • User logins to the HCP System Management Console

Each recorded entry about an event is called a message. The system log contains all the messages written to it since the HCP system was installed.

The System Management Console provides several views of the log:

  • The All Events panel on the System Events page displays all the messages in the system log that your roles allow you to see.
  • The Security panel on the System Events page displays only messages about attempts to log into the System Management Console with an invalid user name. Only users with the security role can see this panel.
  • The Logs section on the Resources page displays all the messages in the system log that your roles allow you to see.
  • The Major Events section on the Overview page displays only messages about major events (for example, the addition or failure of a node).
  • The Events section on the Storage Node page displays only messages about events that relate to a particular node.
  • The Service Events section on the Schedule page displays only messages related to HCP services that can be scheduled to run at specific times.

Viewing the complete event log

The All Events panel on the System Events page lists all event messages logged since the HCP system was installed. By default, the panel displays 20 messages at a time in reverse chronological order.

Before you begin

To view the All Events panel, you need the monitor, administrator, security, service, or compliance role. However, only users with the security role can see messages about attempts to log into the System Management Console with an invalid user name.

You can display the All Events panel.

Procedure

  1. In the top-level menu of the System Management Console, select Monitoring System Events.

  2. On the left side of the System Events page, click All Events.

Viewing the system security log

The Security Events panel on the System Events page lists all messages about attempts to log into the System Management Console with an invalid username that have occurred since the HCP system was installed. By default, the panel displays 20 messages at a time in reverse chronological order.

NoteTo view the Security Events panel, you need the security role.

Before you begin

To view the All Events panel, you need the monitor, administrator, security, service, or compliance role. However, only users with the security role can see messages about attempts to log into the System Management Console with an invalid user name.

You can display the All Events panel.

Procedure

  1. In the top-level menu of the System Management Console, select Monitoring System Events.

  2. On the left side of the System Events page, click Security Events.

Understanding log messages

Each message displayed in the All Events and Security Events panel includes this information about an event:

  • The user name of the event initiator:
    • For user-initiated events, this is the user name currently associated with the user account used by the user who initiated the event. These considerations apply:
      • For an HCP user account, if the account has been deleted, the user name is followed by the letter D in parentheses.
      • For an AD user account, if the account has been deleted or if HCP currently cannot contact AD, the user name for the message is blank.
    • For system-initiated events, the user name is [internal].
    • For events initiated through SNMP, the user name is [snmp].
    • For events initiated by HCP service or support personnel by means other than the System Management Console or SNMP, the user name is [service].
  • The severity of the event. Possible values are:
    • Notice

      The event is normal and requires no special action. Events of this severity are informational only. Examples are:

      • Node started
      • Protection service finished: run complete
      • Syslog settings changed
    • Warning

      The event is out of the ordinary and may require manual intervention. Examples are:

      • Storage capacity warning
      • Protection service beginning repairs
      • Remote authentication server error
    • Error

      The event is serious and most likely requires manual intervention. Examples are:

      • Storage capacity critical
      • Volume failure
      • Network interface down
  • The date and time at which the event occurred, shown for the time zone in which the HCP system is located.
  • A short description of the event.

To view more details about an event, click anywhere in the row containing the event message. To hide the details, click again in the row.

The details displayed for an event are:

  • The user ID of the event initiator
  • For user-initiated events, the port through which HCP received the event request
  • For user-initiated events, the IP address from which the event request was sent
  • The message ID
  • The number of the node on which the event occurred
  • If the event applies to a specific logical volume, the volume ID
  • The full text of the event message

Managing the message list

Before you begin

To view the All Events panel, you need the monitor, administrator, security, service, or compliance role. However, only users with the security role can see messages about attempts to log into the System Management Console with an invalid user name.

You can display the All Events panel.

Procedure

  1. To display details for all the listed events, click expand all. To hide all details, click collapse all.

  2. To view a different number of messages per page, select the number you want in the Items field.

  3. To page forward or backward through the messages, click the next (Page forward icon) or back (Page back icon) control, respectively.

 

  • Was this article helpful?