Chapter 1. Introduction to Syslog Messages

This chapter includes the following sections:

- Syslog Messages

- UCS C-Series Message Severity Terms and Codes

- Cisco IMC Fault Types

- Syslog Message Example and Format

Syslog Messages

Cisco Integrated Management Controller (Cisco IMC) generates system log, or syslog, messages to record the following incidents that take place in the UCS C-Series servers:

- Routine system operations

- Failures and errors

- Critical and emergency conditions

There are three kinds of syslog entries:

- Faults

- Events

- Audit logs

Each syslog message identifies the Cisco IMC process that generated the message and provides a brief description of the operation or error that occurred.

UCS C-Series Message Severity Terms and Codes

Cisco IMC labels each log entry with a severity term. The following table compares the UCS C-Series severity term label for a log entry to the severity term label displayed in the syslog in Cisco IMC:

Severity Terms

Cisco IMC Severity

Syslog Level

info

info

warning

notification

minor

warnings

major

error

crtical

critical

The following table contains the Cisco IMC message severity codes and their descriptions. Severity codes can be used to create filters for monitoring syslog messages.

Severity Codes

Code

Severity

Keyword

Description

0

Emergency

emerg (panic)

Emergency messages indicate that the system is unusable. A panic condition usually affects multiple applications, servers, or sites. Emergency messages can be set to notify all technical staff members who are on call.

1

Alert

alert

Alert messages indicate that action must be taken immediately; staff members who can fix the problem must be notified. An example of an alert message would be the loss of a primary ISP connection.

2

Critical

crit

Critical messages indicate conditions that should be corrected immediately, and also indicate failure in a secondary system. An example of a critical message would be the loss of a backup ISP connection.

3

Error

err

Error messages indicate non-urgent failures. Error messages should be relayed to developers or network administrators, and must be resolved within a specific timeframe.

4

Warning

warning (warn)

Warning messages indicate that that an error will occur if action is not taken, for example, the file system is 85% full. Warnings faults also must be resolved within a specific timeframe.

5

Notice

notice

Notice messages indicate events that are unusual but that are not error conditions. They can be summarized in an email to developers or administrators to spot potential problems, but no immediate action is necessary.

6

Informational

info

Informational messages are associated with normal operational behavior. They may be tracked for reporting, measuring throughput, or other purposes, but no action is required.

7

Debug

debug

Debug messages are useful to developers for debugging the application, but are not useful for tracking operations.

Cisco IMC Fault Types

The table below defines the fault types that are available in Cisco IMC, and their usefulness for monitoring purposes:

Fault Types in Cisco IMC

Type

Description

Monitoring

equipment

Cisco IMC has detected that a physical component is inoperable or has another functional issue.

These faults are essential for service monitoring.

server

Cisco IMC is unable to complete a server task, such as associating a service profile with a server.

These faults are raised during server provisioning or service profile association.

configuration

Cisco IMC is unable to successfully configure a component.

These faults are essential for service monitoring.

environment

Cisco IMC has detected a power problem, thermal problem, voltage problem, or loss of CMOS settings.

These faults are essential for service monitoring.

management

Cisco IMC has detected a serious management issue, such as one of the following:

- Critical services cannot be started.

- The primary switch cannot be identified.

- A software service has become unresponsive.

- Components in the instance include incompatible firmware versions.

These faults are essential for service monitoring.

connectivity

Cisco IMC has detected a connectivity problem, such as an unreachable adapter.

These faults are essential for service monitoring.

network

Cisco IMC has detected a network issue, such as a link down.

These faults are essential for service monitoring.

operational

Cisco IMC has detected an operational issue, such as one of the following:

- A log data store has reached its maximum capacity.

- Files cannot be transferred.

- A server discovery failed.

These faults do not have significant value for remote monitoring.

Syslog Message Example and Format

The following string is an example of a typical Coisco IMC syslog message:

Apr 19 17:11:12 UTC: %CIMC-6-LOG_CAPACITY: [F0461][info][log-capacity][sys/rack-unit-1/mgmt/log-SEL-0] Log capacity on Management Controller on server 1/7 is very-low

The following table lists the Syslog message parts and provides the definition of each part:

Syslog Message

Message Part

Definition

Apr 19 17:11:12 UTC

Date and Time

Provides the date and the time, in UTC format, and indicates when the event or fault occurred.

%CIMC

Facility

Refers to the message source. The message source is usually a hardware device, a protocol, or a module of the system software.

Note

Facility is Cisco-specific and is only relevant within the message string. It is different from facility as defined in RFC 3164 for the syslog protocol. For messages originating from Cisco IMC, the facility will always be %CIMC.

6

Severity

Refers to the syslog severity code.

LOG_CAPACITY

Mnemonic

A device-specific code that uniquely identifies the message, and maps to a fault type in Cisco IMC.

[F0461]

ID

A unique identifier assigned to the fault.

[info]

Cisco IMC Severity

In this example, a basic notification or informational message, possibly independently insignificant.

[log-capacity]

Mnemonic

A device-specific code that uniquely identifies the message and maps to the fault type in Cisco IMC.

[sys/rack-unit-1/mgmt/log-SEL-0]

System

The specific Cisco UCS device in which the fault occurred.

System Event log capacity is very low

Description

A brief description of the fault.

Chapter 2. Configuring Syslog in Cisco IMC

This chapter contains the following sections:

- Syslog Configuration

- Configuring Syslog Using Cisco IMC GUI

- Configuring Syslog Using the Cisco IMC CLI

Syslog Configuration

You can configure syslog in Cisco IMC using both Cisco IMC GUI and the Cisco IMC CLI.

Configuring Syslog Using Cisco IMC GUI

Procedure

Step 1

In the Navigation pane, click the Chassis menu.

Step 2

In the Chassis menu, click Faults and Logs.

Step 3

In the Logging Controls tab, enter the following information:

Remote Logging

Name

Description

Enabled check box

If checked, the Cisco IMC sends log messages to the Syslog server named in the IP Address field.

Host Name/IP Address field

The address of the Syslog server on which the Cisco IMC log should be stored. You can set an IPv4 or IPv6 address or a domain name as the remote system address.

Port field

Enter a destination port number of the Syslog server within the range 1 to 65535. The default port number is 514.

Minimum Severity to Report field

Specify the lowest level of messages that will be included in the remote logs. You can select one of the following:

- Emergency

- Alert

- Critical

- Error

- Warning

- Notice

- Informational

- Debug

Note

The Cisco IMC does not remotely log any messages with a severity below the selected severity. For example, if you select Error, then the Cisco IMC remote log contains all messages with the severity Emergency, Alert, Critical, or Error. It does not show Warning, Notice, Informational, or Debug messages.

Local Logging

This area displays only the Minimum Severity to Report drop-down list as shown in the table above. You can specify the lowest level of messages to be included in the local log

Configuring Syslog Using the Cisco IMC CLI

You can configure profiles for one or two remote syslog servers to receive Cisco IMC log entries.

Before you begin

- The remote syslog server must be configured to receive logs from a remote host.

- The remote syslog server must be configured to receive all types of logs, including authentication-related logs.

- The remote syslog server's firewall must be configured to allow syslog messages to reach the syslog server.

Procedure

Step 1

Server# scope cimc

Enters the Cisco IMC command mode.

Step 2

Server /cimc # scope log

Enters the Cisco IMC log command mode.

Step 3

(Optional) Server /cimc/log # set remote-syslog-severity level

The severity level can be one of the following, in decreasing order of severity:

- emergency

- alert

- critical

- error

- warning

- notice

- informational

- debug

Note

Cisco IMC does not remotely log any messages with a severity below the selected severity. For example, if you select error , then the remote syslog server will receive all Cisco IMC log messages with the severity Emergency, Alert, Critical, or Error. It will not show Warning, Notice, Informational, or Debug messages.

Step 4

Server /cimc/log # scope server {1 | 2 }

Selects one of the two remote syslog server profiles and enters the command mode for configuring the profile.

Step 5

Server /cimc/log/server # set server-ip ipv4 or ipv6 address or domain name

Specifies the remote syslog server address.

Note

You can set an IPv4 or IPv6 address or a domain name as the remote server address.

Step 6

Server /cimc/log/server # set server-port port number

Sets the destination port number of the remote syslog server.

Step 7

Server /cimc/log/server # set enabled {yes | no }

Enables the sending of Cisco IMC log entries to this syslog server.

Step 8

Server /cimc/log/server # commit

Commits the transaction to the system configuration.

Example

This example shows how to configure a remote syslog server profile and enable the sending of Cisco IMC log entries with a minimum severity level of Warning:

Server# scope cimc
Server /cimc # scope log
Server /cimc/log # set remote-syslog-severity warning
Server /cimc/log *# scope server 1
Server /cimc/log/server *# set server-ip www.abc.com
Server /cimc/log/server *# set server-port 514
Server /cimc/log/server *# set protocol udp
Server /cimc/log/server *# set enabled yes
Server /cimc/log/server *# commit
Server /cimc/log/server # exit
Server /cimc/log # show server
Syslog Server 1:
Syslog Server Address: www.abc.com
Syslog Server Port: 514
Enabled: yes

Server /cimc/log # show remote-syslog-severity
Remote Syslog Severity: warning

Server /cimc/log #

Chapter 3. Monitoring Cisco IMC using Syslog

This chapter contains the following sections:

- Monitoring Syslog Messages

- Syslog Messages to Monitor

Monitoring Syslog Messages

Syslog messages contain the event code and fault code. To monitor syslog messages, you can define syslog message filters. The filters can parse the syslog messages based on the criteria you choose. You can use the following criteria to define a filter:

- By event or fault codes: Define a filter with a parsing rule to include only the specific codes that you intend to monitor. All messages that do not match these criteria will be discarded.

- By severity level: Define a filter with a parsing rule to monitor syslog messages with specific severity levels.

Syslog Messages to Monitor

The table below lists some syslog messages that you may want to monitor in Cisco IMC:

Failure

Fault Type

Fault Code and Description

DIMM problems

equipment

F0185 - DIMM [id]/[id] on server [serverid] operability: [operability]

Equipment failures

equipment

F0313 - [Serverid] BIOS failed power-on self testServer [chassisId] BIOS failed power-on self test.

F0374 - Power supply [id] in [serverid] operability: [operability]

F0376 - IOCard [location] on [serverId] is removed.

Thermal problems

environment

F0176/F0177 - Processor [id] on [serverid] temperature:[thermal]

F0187/F0188 - DIMM [location] on [serverid] temperature: [thermal]

F0379 - IOCard [location] on server [id] operState: [operState]

F0382/F0384 - Fan module [tray]-[id] in [serverid] temperature: [thermal]

F0383/F0385 - Power supply [id] in [serverid] temperature: [thermal]

F0409/F0411 - Thermal condition on [serverid] cause: [thermalStateQualifier]

F0539/F0540 - IO Hub on [serverId] temperature: [thermal]

Voltage problems

environment

F0179/F0180 - Processor [id] on [serverId] voltage: [voltage]

F0190/F0191 - Memory array [id] on [serverid] voltage: [voltage]

F0389/F0391 - Power supply [id] in [serverid] voltage: [voltage]

F0425 - CMOS battery voltage on [serverid] is [cmosVoltage]

Power problems

environment

F0310 - Motherboard of [serverid] power: [operPower]

Preface

- Audience

- Conventions

- Related Cisco UCS Documentation

Audience

This guide is intended primarily for data center administrators with responsibilities and expertise in one or more of the following:

- Server administration

- Storage administration

- Network administration

- Network security

Conventions

Text Type

Indication

GUI elements

GUI elements such as tab titles, area names, and field labels appear in this font.

Main titles such as window, dialog box, and wizard titles appear in this font.

Document titles

Document titles appear in this font.

TUI elements

In a Text-based User Interface, text the system displays appears in this font.

System output

Terminal sessions and information that the system displays appear in this font.

CLI commands

CLI command keywords appear in this font .

Variables in a CLI command appear in this font .

[ ]

Elements in square brackets are optional.

{x | y | z}

Required alternative keywords are grouped in braces and separated by vertical bars.

[x | y | z]

Optional alternative keywords are grouped in brackets and separated by vertical bars.

string

A nonquoted set of characters. Do not use quotation marks around the string or the string will include the quotation marks.

< >

Nonprinting characters such as passwords are in angle brackets.

[ ]

Default responses to system prompts are in square brackets.

!, #

An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line.

Note

Means reader take note. Notes contain helpful suggestions or references to material not covered in the document.

Tip

Means the following information will help you solve a problem. The tips information might not be troubleshooting or even an action, but could be useful information, similar to a Timesaver.

Timesaver

Means the described action saves time. You can save time by performing the action described in the paragraph.

Caution

Means reader be careful. In this situation, you might perform an action that could result in equipment damage or loss of data.

Warning

IMPORTANT SAFETY INSTRUCTIONS

This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. Use the statement number provided at the end of each warning to locate its translation in the translated safety warnings that accompanied this device.

SAVE THESE INSTRUCTIONS

Related Cisco UCS Documentation

Documentation Roadmaps

For a complete list of all B-Series documentation, see the Cisco UCS B-Series Servers Documentation Roadmap available at the following URL: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/overview/guide/UCS_roadmap.html

For a complete list of all C-Series documentation, see the Cisco UCS C-Series Servers Documentation Roadmap available at the following URL: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/overview/guide/UCS_rack_roadmap.html.

For information on supported firmware versions and supported UCS Manager versions for the rack servers that are integrated with the UCS Manager for management, refer to Release Bundle Contents for Cisco UCS Software.

Other Documentation Resources

Follow Cisco UCS Docs on Twitter to receive document update notifications.