Log accumulation in the storage system

Audit Log User Guide for VSP E Series and VSP G130, G/F350, G/F370, G/F700, G/F900
Version
88-07-0x
Audience
anonymous
Part Number
MK-97HM85024-10

When the storage system stops transferring logs tosyslogservers due to problems, such as a network failure, the logs get accumulated in the storage system or theSVPas non-transferred logs as a result. This is flagged as a warning on the management interface andSIMis sent, prompting actions by the administrator. In contrast, whensyslogservers are not in use logs also accumulate in the storage system, but this does not generate any flags as it is a normal system behavior.

The following table provides the upper limitations for accumulated non-transferred logs in each storage component.

When audit logs are not transferred

If audit logs are not transferred to syslog servers due to a LAN failure etc., the logs are accumulated as a non-transferred log. Once non-transferred logs are accumulated, the icon showing the accumulated status in the window changes or a SIM is generated.

When syslog servers are not used, logs are accumulated as a non-transferred log, but the icon showing the accumulated status in the window does not change or a SIM is not generated.

Maximum number of lines1 Log status on Device Manager - Storage Navigator SIM

SVP: 250,000 lines

The icon shown in the upper right of the main window changes.

  • : The number of accumulated logs is below the threshold2.
  • : The number of accumulated logs reaches the threshold.
  • : Some audit logs are overwritten and a part of the data is lost because the file is full.

For details about how to handle these problems, see SIM codes.

  • The SIM code 7d03xx3 is generated when the number of accumulated logs reaches the threshold 4.
  • The SIM code 7d04xx3 is generated when some audit logs are overwritten and some data are lost because the file is full.

Storage system (GUM): 1,000 lines

A SIM is generated. For details, see SIM codes.

Storage system (DKC):
  • VSP E series: 300,000 lines
  • VSP F350, F370, F700, F900: 300,000 lines
  • VSP G350, G370, G700, G900: 300,000 lines

Notes:

  1. The number of lines is an estimate, depending on the type of the log information.
  2. The threshold is 70% of the maximum stored capacity of the audit logs. When the audit log file reaches the maximum capacity, the oldest data is lost as it is overwritten by the newest data (wrap around).

  3. xx=00: Indicates an event occurred on the CTL1

    sidexx=01: Indicates an event occurred on the CTL2 side

  4. The threshold is 70% of the maximum stored capacity of the audit logs. When the audit log file reaches the maximum capacity, the oldest data is lost as it is overwritten by the newest data (wrap around).