SIM codes

Audit Log User Guide for VSP E Series

Version

93-07-0x

Audience

anonymous

Part Number

MK-97HM85024-18

The following table shows the SIM codes that were issued and how to handle when not transferred logs were accumulated.

If audit logs are not transferred to syslog servers due to a LAN failure etc., the logs are accumulated as a non-transferred log. Once non-transferred logs are accumulated, the icon showing the accumulated status in the window changes or a SIM is generated.

When syslog servers are not used, logs are accumulated as a non-transferred log, but the icon showing the accumulated status in the window does not change or a SIM is not generated.

SIM code	Event
7d03`xx`¹	The number of accumulated logs reaches the threshold ².
7d04`xx`¹	Some audit logs are overwritten and some data are lost because the file is full.
Notes: `xx`=00: Indicates an event occurred on the CTL1 side `xx`=01: Indicates an event occurred on the CTL2 side The threshold is 70% of the maximum stored capacity of the audit logs. When the audit log file reaches the maximum capacity, the oldest data is lost as it is overwritten by the newest data (wrap around).

SIM code

Event

7d03xx¹

The number of accumulated logs reaches the threshold ².

7d04xx¹

Some audit logs are overwritten and some data are lost because the file is full.

Notes:

xx=00: Indicates an event occurred on the CTL1 side
xx=01: Indicates an event occurred on the CTL2 side
The threshold is 70% of the maximum stored capacity of the audit logs. When the audit log file reaches the maximum capacity, the oldest data is lost as it is overwritten by the newest data (wrap around).

Perform the following when non-transferred logs are accumulated.

Export non-transferred logs.
All stored audit logs including transferred logs are exported in this operation.
Which operation window to be used depends on where the audit logs are stored.

Type/contents of audit log	Stored place	Exporting operation window
Logs of operations set by the management client (Except operations in the maintenance utility menu) Operation logs of encryption keys for encrypting stored data Execution logs of Remote Maintenance API	SVP	Audit Log Properties window
Operation logs of maintenance utility Maintenance operation logs of Maintenance PC Event logs of encryption keys for encrypting stored data Command logs received from a host or computers using CCI the storage system Operation logs for Hitachi Storage Advisor Embedded	Storage system (GUM and DKC)	Audit Log Settings window

Eliminate the cause of the transfer failure to the syslog server, and then conduct a test transfer of syslogs to confirm that the transmission is recovered.
Note: Even if the transmission is recovered, audit logs generated during the transfer failure are not retransferred.

For more information about descriptions on audit log settings and exporting audit logs, see System Administrator Guide.