Introduction to Syslog Messages

This chapter includes the following sections:

Syslog Messages

Cisco UCS Manager generates system log, or syslog, messages to record the following incidents that take place in the Cisco UCS Manager system:

  • Routine system operations
  • Failures and errors
  • Critical and emergency conditions

There are three kinds of syslog entries:

  • Faults
  • Events
  • Audit logs

Each syslog message identifies the Cisco UCS Manager process that generated the message and provides a brief description of the operation or error that occurred.

Cisco UCS Manager Message Severity Terms and Codes

Cisco UCS Manager labels each log entry with a severity term. The following table compares the Cisco UCS Manager severity term label for a log entry to the serverity term label displayed in the syslog in Cisco UCS Manager, release 1.4 and later:

Table 1  Severity Terms
Cisco UCS Manager Severity Syslog Level, Release 1.4 and Later

info

info

warning

notification

minor

warnings

major

error

crtical

critical

The following table contains the Cisco UCS Manager message severity codes and their descriptions. Severity codes can be used to create filters for monitoring syslog messages.

Table 2  Severity Codes

Code

Severity

Keyword

Description

0

Emergency

emerg (panic)

Emergency messages indicate that the system is unusable. A panic condition usually affects multiple applications, servers, or sites. Emergency messages can be set to notify all technical staff members who are on call.

1

Alert

alert

Alert messages indicate that action must be taken immediately; staff members who can fix the problem must be notified. An example of an alert message would be the loss of a primary ISP connection.

2

Critical

crit

Critical messages indicate conditions that should be corrected immediately, and also indicate failure in a secondary system. An example of a critical message would be the loss of a backup ISP connection.

3

Error

err

Error messages indicate non-urgent failures. Error messages should be relayed to developers or network administrators, and must be resolved within a specific timeframe.

4

Warning

warning (warn)

Warning messages indicate that that an error will occur if action is not taken, for example, the file system is 85% full. Warnings faults also must be resolved within a specific timeframe.

5

Notice

notice

Notice messages indicate events that are unusual but that are not error conditions. They can be summarized in an email to developers or administrators to spot potential problems, but no immediate action is necessary.

6

Informational

info

Informational messages are associated with normal operational behavior. They may be tracked for reporting, measuring throughput, or other purposes, but no action is required.

7

Debug

debug

Debug messages are useful to developers for debugging the application, but are not useful for tracking operations.

Cisco UCS Manager Fault Types

The table below defines the fault types that are available in Cisco UCS Manager, and their usefulness for monitoring purposes:
Table 3 Fault Types in Cisco UCS Manager

Type

Description

Monitoring

fsm

An FSM task has failed to complete successfully, or the Cisco UCS Manager is retrying one of the stages of the FSM.

These faults are not intended for remote syslog or SNMP notification.

equipment

Cisco UCS Manager has detected that a physical component is inoperable or has another functional issue.

These faults are essential for service monitoring.

server

Cisco UCS Manager is unable to complete a server task, such as associating a service profile with a server.

These faults are raised during server provisioning or service profile association.

configuration

Cisco UCS Manager is unable to successfully configure a component.

These faults are essential for service monitoring.

environment

Cisco UCS Manager has detected a power problem, thermal problem, voltage problem, or loss of CMOS settings.

These faults are essential for service monitoring.

management

Cisco UCS Manager has detected a serious management issue, such as one of the following:

  • Critical services cannot be started.
  • The primary switch cannot be identified.
  • A software service has become unresponsive.
  • Components in the instance include incompatible firmware versions.

These faults are essential for service monitoring.

connectivity

Cisco UCS Manager has detected a connectivity problem, such as an unreachable adapter.

These faults are essential for service monitoring.

network

Cisco UCS Manager has detected a network issue, such as a link down.

These faults are essential for service monitoring.

operational

Cisco UCS Manager has detected an operational issue, such as one of the following:

  • A log data store has reached its maximum capacity.
  • Files cannot be transferred.
  • A server discovery failed.

These faults do not have significant value for remote monitoring.

Syslog Message Example and Format

The following string is an example of a typical Cisco UCS Manager syslog message:

Apr 19 17:11:12 UTC: %UCSM-6-LOG_CAPACITY: [F0461][info][log-capacity][sys/chassis-1/blade-7/mgmt/log-SEL-0] Log capacity on Management Controller on server 1/7 is very-low

The following table lists the Syslog message parts and provides the definition of each part:

Syslog Message

Message Part

Definition

Apr 19 17:11:12 UTC

Date and Time

Provides the date and the time, in UTC format, and indicates when the event or fault occurred.

%UCSM

Facility

Refers to the message source. The message source is usually a hardware device, a protocol, or a module of the system software.

Note   

Facility is Cisco-specific and is only relevant within the message string. It is different from facility as defined in RFC 3164 for the syslog protocol. For messages originating from Cisco UCS Manager, the facility will always be %UCSM.

6

Severity

Refers to the syslog severity code.

LOG_CAPACITY

Mnemonic

A device-specific code that uniquely identifies the message, and maps to a fault type in Cisco UCS Manager.

[F0461]

ID

A unique identifier assigned to the fault.

[info]

UCSM Severity

In this example, a basic notification or informational message, possibly independently insignificant.

[log-capacity]

Mnemonic

A device-specific code that uniquely identifies the message and maps to the fault type in Cisco UCS Manager.

[sys/chassis-1/blade- 7/mgmt/log-SEL-0]

System

The specific Cisco UCS device in which the fault occurred.

Log capacity on Management Controller on server 1/7 is very-low

Description

A brief description of the fault.

Note

For more information about Cisco UCS Manager faults, refer tohttp:/​/​www.cisco.com/​en/​US/​docs/​unified_computing/​ucs/​ts/​faults/​reference/​2.0/​UCSFaultsErrorsRef_​20.html.

Syslog Messages for Cisco UCS Manager Faults

A fault is an abnormal condition or defect at the component, equipment, or subsystem level which may lead to a failure. Faults are categorized by their severity, and the message part of the syslog entry contains text that lets you see the criticality of the fault. Faults can also be managed using SNMP. For more information about managing faults using SNMP, refer to the http:/​/​www.cisco.com/​en/​US/​docs/​unified_computing/​ucs/​sw/​mib/​b-series/​b_​UCS_​MIBRef.html.

The following are a few examples of syslog messages generated for fault events:

  • 2011 Apr 19 17:11:12 UTC: %UCSM-6-LOG_CAPACITY: [F0461][info][log-capacity][sys/chassis-1/blade-7/mgmt/log-SEL-0] Log capacity on Management Controller on server 1/7 is very-low
  • 2011 Apr 20 14:33:14 UTC: %UCSM-3-CONFIGURATION_FAILURE: [F0327][major][configuration-failure][org-root/ls-test] Service profile test configuration failed due to insufficient-resources,mac-address-assignment,system-uuid-as
  • 2011 Apr 20 20:50:25 UTC: %UCSM-3-THERMAL_PROBLEM: [F0382][major][thermal-problem][sys/chassis-1/fan-module-1-1] Fan module 1/1-1 temperature: lower-critical
  • 2011 Apr 20 14:33:14 UTC: %UCSM-5-UNASSOCIATED: [F0334][warning][unassociated][org-root/ls-test] Service profile test is not associated

Syslog Messages for Cisco UCS Manager Events

Event messages are generated when an FSM transitions from one state to another. Event messages notify you of the transitions of all FSMs, and may contain information about a specific user when a user invokes a process that updates the state of an FSM.


Note
All FSM event messages are delivered with the info security level in syslog.

The following are a few examples of syslog messages generated by system events:

  • 2011 Apr 22 16:53:18 UTC: %UCSM-6-EVENT: [E4195931][456249][transition][ucs-username\username][] [FSM:BEGIN]: Hard-reset server sys/chassis-1/blade-7(FSM:sam:dme:ComputePhysicalHardreset)
  • 2011 Apr 22 16:53:18 UTC: %UCSM-6-EVENT: [E4195931][456250][transition][ucs-username\username][] [FSM:STAGE:END]:(FSM-STAGE:sam:dme:ComputePhysicalHardreset:begin)
  • 2011 Apr 22 16:53:18 UTC: %UCSM-6-EVENT: [E4195932][456251][transition][ucs-username\username][] [FSM:STAGE:ASYNC]: Preparing to check hardware configuration server sys/chassis-1/blade-7(FSM-STAGE:sam:dme:ComputePhysicalHa
  • 2011 Apr 22 16:53:23 UTC: %UCSM-6-EVENT: [E4195932][456252][transition][internal][] [FSM:STAGE:STALE-SUCCESS]: Preparing to check hardware configuration server sys/chassis-1/blade-7(FSM-STAGE:sam:dme:ComputePhysicalHardres
  • 2011 Apr 22 16:53:23 UTC: %UCSM-6-EVENT: [E4195932][456253][transition][internal][] [FSM:STAGE:END]: Preparing to check hardware configuration server sys/chassis-1/blade-7(FSM-STAGE:sam:dme:ComputePhysicalHardreset:PreSani
  • 2011 Apr 25 18:27:01 UTC: %UCSM-6-EVENT: [E4196181][535831][transition][internal][] [FSM:END]: Hard-reset server sys/chassis-1/blade-7(FSM:sam:dme:ComputePhysicalHardreset)

Syslog Messages for Cisco UCS Manager Audit Logs

An audit log entry describes an activity that takes place in the Cisco UCS Manager system. It identifies what took place, when it took place, where it took place (in what physical resource), and who was responsible. Audit log entries track actions that are initiated by system users.


Note
All audit log messages are delivered with the info security level in syslog.

The following are a few examples of system audit log messages that are logged to syslog:

  • 2011 May 15 10:19:14 UTC: %UCSM-6-AUDIT: [session][internal][creation][] Web B: remote user ibm logged in from 172.25.206.73
  • 2011 Apr 22 16:53:18 UTC: %UCSM-6-AUDIT: [admin][ucs-username\username][modification][] server 1/7 power-cycle/reset action requested: hard-reset-immediate
  • 2011 Apr 20 14:33:14 UTC: %UCSM-6-AUDIT: [admin][username][creation][] service profile test created
  • 2011 Apr 20 14:33:14 UTC: %UCSM-6-AUDIT: [admin][username][creation][] service profile Power MO created
  • 2011 Apr 20 14:33:14 UTC: %UCSM-6-AUDIT: [admin][username][creation][] Ether vnic eth1 created
  • 2011 Apr 20 14:33:14 UTC: %UCSM-6-AUDIT: [admin][username][creation][] Ethernet interface created