How can I use EventReporter to forward the NetApp Event Log?

Support, Questions and Discussions on EventReporter

Moderator: alorbach

Google Ads


Re: How can I use EventReporter to forward the NetApp Event Log?

Postby alorbach » Tue Feb 09, 2010 1:55 pm

But it is processing the Events, is it?

This shouldn't take to much CPU, can you send me an export of your configuration to support@adiscon.com?
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: How can I use EventReporter to forward the NetApp Event Log?

Postby jeffcai » Tue Feb 09, 2010 4:25 pm

I do not think it is processing events, because there is no output from the syslog server.

I tried to stop and restart the service, from the debug log, the nLastRecord is always 5000.

I have send the export to support@adiscon.com, please check.

Thanks,
Jeff
jeffcai
Avarage
 
Posts: 10
Joined: Thu Feb 04, 2010 5:38 pm

Re: How can I use EventReporter to forward the NetApp Event Log?

Postby alorbach » Tue Feb 09, 2010 4:41 pm

Hi,

if the LastRecord stays at 5000, this means EventReporter has already processed all EventLog records till the end.
In order to reprocess it, you will need to reset the LastRecord to 0, this should also reset the checksum pointer in the registry (Which is used if the Checksum Option is enabled).
Also note that you are using syslog udp, which isn't very reliable. So EventReporter doesn't know if the message was successfully received, and so can't report it.

best regards,
Andre Lorbach

Edit: Hrm strange after reviewing your debuglog, it looks like the EventReporter service is blocking at some position.
Can you try to reset the LastRecord to 0 and see if you stops at 5000 again?
alorbach
Site Admin
 
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Re: How can I use EventReporter to forward the NetApp Event Log?

Postby jeffcai » Tue Feb 09, 2010 5:06 pm

There should be still have logs in the eventlog, the last output from syslog is not the latest log in the eventlog.

I have set the LastRecord to 0 and it is stopped at 5000 again. When stopped, the last output of the syslog is the last record in the eventlog. Then new logs recorded in the eventlog, CPU goes to 100% again.

Thanks,
Jeff
jeffcai
Avarage
 
Posts: 10
Joined: Thu Feb 04, 2010 5:38 pm

Re: How can I use EventReporter to forward the NetApp Event Log?

Postby dadiaz » Mon Feb 22, 2010 8:47 pm

Jeff:

I ve been following your blog, and have had some of the very same problems with the NetApp Event logs stopping at 5000. I have discovered a workaround that seems to work just fine.

I have found that if you deselect the option to "Always search for the last processed Event using the Checksum" that the events are captured from NetApp just fine. I.e they do not stop at 5000. I do however have the "Use Checksum to verify that last processed event" check box selected. I have shared this workaround with Adiscon and they are going to look into what is going on. Their response was:

"There seems to be something wrong then with this Option, at least we have a direction where the issue is located".

Best of Luck

:wink:

David Diaz
Minneapolis, Minnesota
dadiaz
New
 
Posts: 1
Joined: Tue Feb 16, 2010 4:11 pm

Google Ads


Previous

Return to EventReporter

Who is online

Users browsing this forum: No registered users and 0 guests

cron