SIM codes for audit logs

System Administrator Guide for VSP One Block 85

Version

A0-05-4x

Audience

anonymous

Part Number

MK-26VSP1B030-03

ft:lastEdition

2026-06-22

If audit logs are not transferred to syslog servers, for example, due to a LAN failure, the logs are accumulated as a non-transferred log. When non-transferred logs begin accumulating, the icon in the window showing the accumulated status changes or a SIM is generated.

When syslog servers are not used, audit logs are accumulated as a non-transferred log, but the icon showing the accumulated status does not change and a SIM is not generated.

The following table lists and describes the SIM codes that are issued when non-transferred audit logs have accumulated. When you are using a syslog server and non-transferred logs have accumulated, export the audit logs. When you export the audit logs, all stored audit logs, including transferred and non-transferred logs, are exported.

SIM code	Event
7d03`xx` `xx` = 00: Indicates an event occurred on the AMC-0 side `xx` = 01: Indicates an event occurred on the AMC-1 side	Some audit logs were overwritten because the capacity of audit logs stored in the ESM reached its maximum. Also, some more audit logs might be overwritten because non-transferred audit logs were accumulated.
7d04`xx` `xx` = 00: Indicates an event occurred on the AMC-0 side `xx` = 01: Indicates an event occurred on the AMC-1 side	Non-transferred audit logs were accumulated, and the number of accumulated logs reached the threshold. The threshold value of audit logs that can be accumulated is 128 lines.

SIM code

Event

7d03xx

xx = 00: Indicates an event occurred on the AMC-0 side
xx = 01: Indicates an event occurred on the AMC-1 side

Some audit logs were overwritten because the capacity of audit logs stored in the ESM reached its maximum. Also, some more audit logs might be overwritten because non-transferred audit logs were accumulated.

7d04xx

xx = 00: Indicates an event occurred on the AMC-0 side
xx = 01: Indicates an event occurred on the AMC-1 side

Non-transferred audit logs were accumulated, and the number of accumulated logs reached the threshold.

The threshold value of audit logs that can be accumulated is 128 lines.

The following table shows where audit logs are stored and where you can export audit logs.

Type/contents of audit log	Location	Maintenance utility window
Operation logs of the maintenance utility Maintenance operation logs of the maintenance PC Event logs of the encryption keys for encrypting stored data Command logs received from a host or computer using CCI Logs of operation requests that the storage system received from VSP One Block Administrator	Storage system (ESM and DKC)	Audit Log Settings window

The following table describes the SIM code that is issued when transmission of audit logs fails and and provides recommended action to resolve the problem.

Eliminate the cause of the transfer failure to the syslog server, and then conduct a test transfer of syslogs to confirm that the transmission is recovered. Even if the transmission is recovered, audit logs generated during the transfer failure are not retransferred.

SIM code	Event	Recommended action
7d1a`xx` `xx` = 00: Indicates an event occurred on AMC-0 `xx` = 01: Indicates an event occurred on AMC-1	Transmission of audit logs to the syslog server failed due to the one of the following reasons: The certificate that has been set is invalid. The certificate that has been set has expired. Temporary communication failure This SIM code is also issued if a temporary communication failure occurs when audit logs are transferred to the syslog server. The communication failure is recovered if a test message is successfully sent to the syslog server. If a test transfer fails, check the network environment and take actions as necessary. Even if the network environment is normal, if temporary communication failures frequently occur, contact customer support.	Take the following actions when transmission of audit logs fails: Export non-transferred logs. All stored audit logs including transferred logs are exported in this operation. Eliminate the cause of the transfer failure to the syslog server, and then conduct a test transfer of syslogs to confirm that the transmission is recovered. If TLS/RFC5424 is used as the syslog transfer protocol, confirm that the syslog server certificate file and client certificate file satisfy the requirements and that the syslog server satisfies the requirements for TLS communication.

SIM code

Event

Recommended action

7d1axx

xx = 00: Indicates an event occurred on AMC-0
xx = 01: Indicates an event occurred on AMC-1

Transmission of audit logs to the syslog server failed due to the one of the following reasons:

The certificate that has been set is invalid.
The certificate that has been set has expired.
Temporary communication failure
This SIM code is also issued if a temporary communication failure occurs when audit logs are transferred to the syslog server. The communication failure is recovered if a test message is successfully sent to the syslog server. If a test transfer fails, check the network environment and take actions as necessary. Even if the network environment is normal, if temporary communication failures frequently occur, contact customer support.

Take the following actions when transmission of audit logs fails:

Export non-transferred logs.
All stored audit logs including transferred logs are exported in this operation.
Eliminate the cause of the transfer failure to the syslog server, and then conduct a test transfer of syslogs to confirm that the transmission is recovered.
If TLS/RFC5424 is used as the syslog transfer protocol, confirm that the syslog server certificate file and client certificate file satisfy the requirements and that the syslog server satisfies the requirements for TLS communication.