Skip to main content
Close

We've Moved!

Product Documentation has moved to docs.hitachivantara.com
Hitachi Vantara Knowledge

Logging

  1. Last updated
  2. Save as PDF

The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Child Topics

Overview

A log file provides historical data on user operations performed on the storage system as well as program behaviors resulted from the operations. It reveals who did what to the storage system and it can be a helpful tool for investigating problems or conducting non-technical departmental audits.

Depending on the types of logs, collected logs are stored in either the SVP or the storage system. In order to access the collected logs, the storage system must be configured to transfer logs to syslog servers. Once configured, logs are automatically transferred to the syslog servers from the storage system or the SVP.

NoteThe SVP's log storage capacity is limited. When the stored logs reaches the maximum capacity, the SVP overwrites the oldest data with the newest data. It is recommended to transfer audit logs to syslog servers.

The stored audit logs can be transferred to a syslog server.

Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Log accumulation in the storage system
When the storage system stops transferring logs tosyslogservers due to problems, such as a network failure, the logs get accumulated in the storage system or theSVPas non-transferred logs as a result. This is flagged as a warning on the management interface andSIMis sent, prompting actions by the administrator. In contrast, whensyslogservers are not in use logs also accumulate in the storage system, but this does not generate any flags as it is a normal system behavior.

The following table provides the upper limitations for accumulated non-transferred logs in each storage component.

When audit logs are not transferred

If audit logs are not transferred to syslog servers due to a LAN failure etc., the logs are accumulated as a non-transferred log. Once non-transferred logs are accumulated, the icon showing the accumulated status in the window changes or a SIM is generated.

When syslog servers are not used, logs are accumulated as a non-transferred log, but the icon showing the accumulated status in the window does not change or a SIM is not generated.

Maximum number of lines1 Log status on Device Manager - Storage Navigator SIM
SVP: 250,000 lines The icon shown in the upper right of the main window changes.
  • GUID-29442324-5CBA-44F3-8EFF-D647615CF1D7-low.png: The number of accumulated logs is below the threshold2.
  • GUID-C3BC5545-E30B-454C-A4E3-0104D1F975E1-low.png: The number of accumulated logs reaches the threshold.
  • GUID-58501DA6-6805-45F0-A384-E29E64D1E751-low.png: Some audit logs are overwritten and a part of the data is lost because the file is full.

For details about how to handle these problems, see SIM codes.

  • The SIM code 7d03xx3 is generated when the number of accumulated logs reaches the threshold 4.
  • The SIM code 7d04xx3 is generated when some audit logs are overwritten and some data are lost because the file is full.
Storage system (GUM): 1,000 lines A SIM is generated. For details, see SIM codes.
Storage system (DKC): 300,000 lines
Notes:
  1. The number of lines is an estimate, depending on the type of the log information.
  2. The threshold is 70% of the maximum stored capacity of the audit logs. When the audit log file reaches the maximum capacity, the oldest data is lost as it is overwritten by the newest data (wrap around).
  3. xx=00: Indicates an event occurred on the CTL1.

    sidexx=01: Indicates an event occurred on the CTL2 side.

  4. The threshold is 70% of the maximum stored capacity of the audit logs. When the audit log file reaches the maximum capacity, the oldest data is lost as it is overwritten by the newest data (wrap around).
Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Child Topics

SIM codes

The following table shows the SIM codes that were issued and how to handle when not transferred logs were accumulated.

If audit logs are not transferred to syslog servers due to a LAN failure etc., the logs are accumulated as a non-transferred log. Once non-transferred logs are accumulated, the icon showing the accumulated status in the window changes or a SIM is generated.

When syslog servers are not used, logs are accumulated as a non-transferred log, but the icon showing the accumulated status in the window does not change or a SIM is not generated.

SIM code

Event

7d03xx1

The number of accumulated logs reaches the threshold 2.

7d04xx1

Some audit logs are overwritten and some data are lost because the file is full.

Notes:

  1. xx=00: Indicates an event occurred on the CTL1 side

    xx=01: Indicates an event occurred on the CTL2 side

  2. The threshold is 70% of the maximum stored capacity of the audit logs. When the audit log file reaches the maximum capacity, the oldest data is lost as it is overwritten by the newest data (wrap around).

Perform the following when non-transferred logs are accumulated.

  • Export non-transferred logs.

    All stored audit logs including transferred logs are exported in this operation.

  • Which operation window to be used depends on where the audit logs are stored.

Type/contents of audit log

Stored place

Exporting operation window

  • Logs of operations set by the management client (Except operations in the maintenance utility menu)
  • Operation logs of encryption keys for encrypting stored data
  • Execution logs of Remote Maintenance API

SVP

Audit Log Properties window

  • Operation logs of maintenance utility
  • Maintenance operation logs of Maintenance PC
  • Event logs of encryption keys for encrypting stored data
  • Command logs received from a host or computers using CCI the storage system
  • Operation logs for Hitachi Storage Advisor Embedded

Storage system (GUM and DKC)

Audit Log Settings window

  • Eliminate the cause of the transfer failure to the syslog server, and then conduct a test transfer of syslogs to confirm that the transmission is recovered.
    NoteEven if the transmission is recovered, audit logs generated during the transfer failure are not retransferred.

For more information about descriptions on audit log settings and exporting audit logs, see System Administrator Guide.

Parent Topic

Audit log files

In an event the storage system stops transferring logs to syslog servers, you can export the accumulated non-transferred logs after getting notified of such event. Export operations will export all logs stored in the system including transferred logs. Eliminate the cause of the transfer failure and confirm that transfer is recovered.

NoteEven if the transmission is recovered, audit logs generated during the transfer failure are not re-transferred.

Determine what tool to use to export using the information provided in the following table:

Type or contents of audit log

Storage place

Exporting operation window

  • Logs of operations set by the management client (Except operations in the Maintenance Utility menu)
  • Operations and events on encryption keys for encrypting stored data.
  • Execution logs of Remote Maintenance API,
SVP

Audit Log Properties window

  • Operation logs of maintenance utility
  • Maintenance operation logs of Maintenance PC
  • Event logs of encryption keys for encrypting stored data
  • Command logs received from a host or computers using CCI the storage system
Storage system (Maintenance utility and DKC)

Audit Log Settings window

Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Audit log settings window

The following figure is the Audit Log Setting window in the maintenance utility.

GUID-CE564DC0-13DC-4D6E-BCF5-D44A99F1CA41-low.png

The Audit Log Settings window shows the current audit log settings. Select one of more of the three tabs to change the settings.

Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Setting up a syslog server

Use the following procedure to set up a syslog server for your storage system.

CautionIf you specify the IP address of the syslog server in IPv6 address format, do not use the following IP addresses:
  • Invalid value: [::]
  • Loopback address: [::1]
  • Multicast address: [FF00:: - FDFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF]
  • IPv4-mapped IPv6 address: [::FFFF:(IPv4)]
  • Link-local address: [FE80::]
  • Global unicast address: [2001::]
  • Global unicast address: [2002::]

Before you begin

  • You must have the Audit Log Administrator (View & Modify) role to perform this task.

Procedure

  1. In the maintenance utility, expand the Administration tree, and then select Audit Log Settings.

  2. Click Set Up Syslog Server.

  3. In the Set Up Syslog Server for Audit Logs window:

    1. Select the desired Transfer Protocol.

    2. Enable or disable the Primary Server.

    3. Enable or disable the Secondary Server.

    4. Enter the Location Identification Name.

    5. Enable or disable the Retry. If enabled, enter the desired retry interval.

    6. Enable or disable the Output Detailed Information.

  4. When are finished specifying the syslog server settings, click Apply to save the settings and close the window.

Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Exporting audit log files stored in the SVP

  1. In the main window, click Audit Log on the menu bar.

    The icons on the menu bar show the accumulated status of the audit log files.

  2. From the Audit Log Properties window, click Download (SVP) to export logs operated by the Device Manager - Storage Navigator client computer (SVP window). Click Download (DKC) to export commands sent from a host or computers using CCI or logs of events on encryption keys.

    The preparation message appears. GUID-89922D99-230E-4F66-B345-3AB16ED1AB82-low.png

    Item

    Description

    Usage Rate

    Indicates how much of storage capacity of the non-transfer audit logs is used in comparison to the maximum storage capacity.

    Download (SVP)

    Audit logs of the following contents or type are exported:

    • Operation set by the client PC
    • Operation logs of encryption keys for encrypting stored data
    • Execution logs of Remote Maintenance API

  3. Click OK.

    A window opens where you can specify the export destination.

  4. Specify the export destination and file name, and then click Save.

    NoteWhen you download a file, make sure you click Save within 30 minutes after the window for selecting a download destination folder appears. If you click Save after 30 minutes have elapsed, an error message (20121-107091) appears. If this error message is displayed, retry downloading the file.

  5. Click Close.

Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Exporting audit log files stored in the storage system

You can export audit logs from either the controller or the GUM located on the controller.

The storage system has two controllers, so to get audit logs for the complete system, you must log-in to the maintenance utility on each controller to export the audit log individually.

Before you begin

You must have the Audit Log Administrator (View Only) role to perform this task.

Procedure

  1. In the maintenance utility under Administration menu, select Audit Log Settings.

  2. Click Export Audit Log in the Audit Log Settings window to select GUM or DKC.

  3. Click OK.

    NoteIf the certificate is not valid during an HTTPS connection, the security warning message is displayed. Make sure to take the following actions within 30 seconds. The audit logs cannot be exported after 30 seconds. Go back to step 2.
    • Microsoft Edge: Click Advanced and then Continue to <IP-address-or-host-name> (unsafe).
    • Google Chrome: Click Advanced, and then click Proceed to <IP-address> (unsafe).
    • Internet Explorer: Click Continue to this website (not recommended).

  4. Save the file to the folder containing audit logs.

    NoteIf you change the location identification name of a syslog server, the location identification name on new audit logs could be changed retroactively.
    NoteIf you change the UTC time zone setting of the storage system, the times recorded on new audit logs could be changed retroactively.
Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Send test message to syslog server

Use the following procedure to send a test audit log message to the syslog server.

Before you begin

You must have the Audit Log Administrator (View Only) role to perform this task.

Procedure

  1. In the maintenance usage Administration tree, select Audit Log Settings.

  2. Click Send Test Message to Syslog Server. The following message box opens:

    GUID-04216AB5-E7E2-4F9B-8C99-9C3A7743C9CA-low.png

  3. Click OK to close the message box. Check the syslog server messages and verify that the test message was received and is on the server.

Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.

Next Steps
Parent Topic
  • Logging

    The audit log files contain records of the operations performed on the storage system, including the user who performed the operation and the date and time, as well as the storage system behaviors resulting from the operations. For storage systems with an SVP, the audit log files are stored in the SVP or in the storage system depending on the type of log. For storage systems without an SVP, the audit log files are stored in the storage system. To access the collected log files, you must configure the storage system to transfer the log files to the syslog server and export an audit log file before you can view an audit log for the storage system.