Introduction to Syslog Messages

This chapter includes the following sections:

Syslog Messages

Cisco Integrated Management Controller (Cisco IMC) generates system log, or syslog, messages to record the following incidents that take place in the UCS C-Series servers:

  • Routine system operations

  • Failures and errors

  • Critical and emergency conditions

There are three kinds of syslog entries:

  • Faults

  • Events

  • Audit logs

Each syslog message identifies the Cisco IMC process that generated the message and provides a brief description of the operation or error that occurred.

UCS C-Series Message Severity Terms and Codes

Cisco IMC labels each log entry with a severity term. The following table compares the UCS C-Series severity term label for a log entry to the severity term label displayed in the syslog in Cisco IMC:

Table 1. Severity Terms
Cisco IMC Severity Syslog Level

info

info

warning

notification

minor

warnings

major

error

crtical

critical

The following table contains the Cisco IMC message severity codes and their descriptions. Severity codes can be used to create filters for monitoring syslog messages.

Table 2. Severity Codes

Code

Severity

Keyword

Description

0

Emergency

emerg (panic)

Emergency messages indicate that the system is unusable. A panic condition usually affects multiple applications, servers, or sites. Emergency messages can be set to notify all technical staff members who are on call.

1

Alert

alert

Alert messages indicate that action must be taken immediately; staff members who can fix the problem must be notified. An example of an alert message would be the loss of a primary ISP connection.

2

Critical

crit

Critical messages indicate conditions that should be corrected immediately, and also indicate failure in a secondary system. An example of a critical message would be the loss of a backup ISP connection.

3

Error

err

Error messages indicate non-urgent failures. Error messages should be relayed to developers or network administrators, and must be resolved within a specific timeframe.

4

Warning

warning (warn)

Warning messages indicate that that an error will occur if action is not taken, for example, the file system is 85% full. Warnings faults also must be resolved within a specific timeframe.

5

Notice

notice

Notice messages indicate events that are unusual but that are not error conditions. They can be summarized in an email to developers or administrators to spot potential problems, but no immediate action is necessary.

6

Informational

info

Informational messages are associated with normal operational behavior. They may be tracked for reporting, measuring throughput, or other purposes, but no action is required.

7

Debug

debug

Debug messages are useful to developers for debugging the application, but are not useful for tracking operations.

Cisco IMC Fault Types

The table below defines the fault types that are available in Cisco IMC, and their usefulness for monitoring purposes:
Table 3. Fault Types in Cisco IMC

Type

Description

Monitoring

equipment

Cisco IMC has detected that a physical component is inoperable or has another functional issue.

These faults are essential for service monitoring.

server

Cisco IMC is unable to complete a server task, such as associating a service profile with a server.

These faults are raised during server provisioning or service profile association.

configuration

Cisco IMC is unable to successfully configure a component.

These faults are essential for service monitoring.

environment

Cisco IMC has detected a power problem, thermal problem, voltage problem, or loss of CMOS settings.

These faults are essential for service monitoring.

management

Cisco IMC has detected a serious management issue, such as one of the following:

  • Critical services cannot be started.

  • The primary switch cannot be identified.

  • A software service has become unresponsive.

  • Components in the instance include incompatible firmware versions.

These faults are essential for service monitoring.

connectivity

Cisco IMC has detected a connectivity problem, such as an unreachable adapter.

These faults are essential for service monitoring.

network

Cisco IMC has detected a network issue, such as a link down.

These faults are essential for service monitoring.

operational

Cisco IMC has detected an operational issue, such as one of the following:

  • A log data store has reached its maximum capacity.

  • Files cannot be transferred.

  • A server discovery failed.

These faults do not have significant value for remote monitoring.

Syslog Message Example and Format

The following string is an example of a typical Coisco IMC syslog message:

Apr 19 17:11:12 UTC: %CIMC-6-LOG_CAPACITY: [F0461][info][log-capacity][sys/rack-unit-1/mgmt/log-SEL-0] Log capacity on Management Controller on server 1/7 is very-low

The following table lists the Syslog message parts and provides the definition of each part:

Syslog Message

Message Part

Definition

Apr 19 17:11:12 UTC

Date and Time

Provides the date and the time, in UTC format, and indicates when the event or fault occurred.

%CIMC

Facility

Refers to the message source. The message source is usually a hardware device, a protocol, or a module of the system software.

Note 

Facility is Cisco-specific and is only relevant within the message string. It is different from facility as defined in RFC 3164 for the syslog protocol. For messages originating from Cisco IMC, the facility will always be %CIMC.

6

Severity

Refers to the syslog severity code.

LOG_CAPACITY

Mnemonic

A device-specific code that uniquely identifies the message, and maps to a fault type in Cisco IMC.

[F0461]

ID

A unique identifier assigned to the fault.

[info]

Cisco IMC Severity

In this example, a basic notification or informational message, possibly independently insignificant.

[log-capacity]

Mnemonic

A device-specific code that uniquely identifies the message and maps to the fault type in Cisco IMC.

[sys/rack-unit-1/mgmt/log-SEL-0]

System

The specific Cisco UCS device in which the fault occurred.

System Event log capacity is very low

Description

A brief description of the fault.