toasters

toasters@lists.teaparty.net

13514 discussions

RE: Toasters - How can one forward auditlog events to syslog
by Perry, Jay 26 Mar '02

26 Mar '02

A while back, Alek asked if there was a way to forward auditlog events to a syslog. Since that time, we (Alek and I) have come up with a solution that is available on the NOW website as a Knowledgebase solution titled "How do I forward audit log messages to a syslog log host?" (solution ID ntapcs5526). For those that don't have NOW access, I am posting it here as well. Alek has had this in production for a while now (about a month), and as far as I know it is working out OK (although it required some new filtering, as the auditlog messages are much more verbose than the syslog messages - multiple lines and so forth). To set this up, you must modify the syslog.conf file on the loghost and the /etc/syslog.conf file on the filer or NetCache appliance that is the source of the messages. (For more information about the filer's syslog.conf file, see the respective Data ONTAP man page). Here are detailed steps: 1) On the log host, modify syslog.conf as follows: Add a line: local7.*[one_or_more_tabs][path_to_log_file] Basically, the auditlog messages will arrive as facility local7. 2) Make sure that any selectors of the form *.<level> get changed to *.<level>;local7.none. Otherwise those selectors will receive all of the audit log messages as well. 3) After completing your changes to syslog.conf on the log host, force the syslog daemon to reload its configuration file (on many systems this will involve sending a HUP signal to a process called syslogd). Refer to your log host's OS manuals for details on how this is done for your particular OS. 4) Modify the filer's /etc/syslog.conf file as follows: Add a line: cmdsaudit.auditlog[one_or_more_tabs]@[loghost_ip_or_name] The filer will automatically detect the change to syslog.conf and load it. This may take a couple of minutes though. You will know the change took place because a syslog message will appear that looks like: Wed Feb 20 21:58:52 GMT [syslogd:info]: syslogd: restarted It is worth noting that audit log messages are much more verbose than syslog messages. A typical syslog entry is a single line. A typical audit log entry looks like: date [method of access] :START:command incoming hostname date [method of access] :IN:command "input" command being sent to filer date [method of access] :OUT: output from command (may be multiple lines) date [method of access] :END:command Hope you find this useful, and thanks to Alek for helping out with this! Jay Perry jay.perry(a)netapp.com > -----Original Message----- > From: Alek O. Komarnitsky (N-CSC) [mailto:alek@ast.lmco.com] > Sent: Wednesday, February 20, 2002 8:08 AM > To: toasters(a)mathworks.com > Subject: Toasters - How can one forward auditlog events to syslog > > > I've searched the archives for the answer to this question > and searched > with Google, but have not found it ... yet! ;-) > > We use syslog quite a bit to log stuff remotely, but there are > certain events (such as root rsh activity) that are logged into > auditlog that do NOT show up in syslog - we are logging *.info. > > Is there a way to get those events also sent to syslog > so that we can use what is defined in /etc/syslog.conf to > forward those events to our loghosts? > > Thanx, > alek >

1 0

Re: SNMP Failure Detection
by Don Cunningham 26 Mar '02

26 Mar '02

This could be related to a similar situation we saw recently with a failed disk. We don't use SNMP but the filer email notification facility. Anyway, a disk failed and was subsequently removed by the OS and didn't generate an email. So essentially the system didn't know that the disk ever existed - similar to what you describe. I placed a call to NetApp and they said this shouldn't ever happen(the OS automatically removing a failed disk) and that it is a bug that will be fixed in a later release. Check your system log for a disk failure message followed immediately by a removal message for the failed disk. If it's there then you've probably got the bug. Regards, _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ Don Cunningham - UNIX SysAdmin _/ Progress Software Corp. _/ _/ don.cunningham(a)progress.com _/ 14 Oak Park _/ _/ (781)280-4252 _/ Bedford, MA 01730-1485 _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ "Wherever beer is brewed, all is well - whenever beer is _/ _/ drunk, life is good." -Czech proverb _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ > > Hello Toasters. > > I've been using a script to monitor disk failures on our filers. It's worked pretty well in the past, but I've hit a snag today... > > Normally I can tell if a disk has failed in one of two ways: > 1) Check the SNMP "disks.failed" value, if !eq 1, we've got a problem. > 2) Check via SNMP, the total number of disks, then check the number of active disks, and add to it the number of spare disks. If total disks !eq to active plus spare disk, then there is a failure. > > The second method is often needed for the failures that "slip through the cracks", and is sufficent. However today a disk failed and in doing so was removed from the TOTAL disk count, and not added as a failed disk, so in a case where I have 84 disks, I get the following output from my script: > > The global message is: "The system's global status is normal. " > Total disk count is: 83 > The Active Disk Count is: 82 > The Spare Disk Count is: 1 > The Failed Disk Count is: 0 > > > I've omitted the non-relevent output from my script, which does simple snmpget's from the Net-SNMP app. Anyway, three things went wrong here, > the global message doesn't reflect a failure. The total disk count was decremented when it should not have and the failed disk count is still eq to zero. > Now, because I know that all our filers should always have 2 spare disks I can rewrite my scripts to look for this, however I had previously written them in a very portable way, which hardcoding the number of spares to look for will degridate... > > Any ideas why this happens? I'm sure I'm not the only one who's seen this. > > Ben Rockwood > brockwood(a)homestead-inc.com

1 0

Jinjiang Shengyi Shoes Co., Ltd. (Manufcturer)
by mike 26 Mar '02

26 Mar '02

Dear Sir or Madam:, OUR COMPANY--Jinjiang R-Start Shoes Trading Co., Ltd.-- HAS SUCCESSFULLY INCOPORATED ONE SHOE'S FACTORY- SHENGYI SHOES CO.. NOW OUR ORIGINAL COMPANY'S NAME HAS BEEN RENAMED- JINJIANG SHENGYI SHOES CO., LTD. THAT'S MEANS, WE HAVE TRANSFORMED A PROFESSIONAL SHOE'S MANUFACTURER. SHOULD OUR TRANSFORMATION BRING INCONVINIENCE TO YOU, WISH TO FORGIVE IT. HOPE OUR NEW ROLE WOULD HELP TO FURTHER OUR BUSINESS RELATIONS IN THE FUTURE! ÎÒ¹«ËŸÔÃû"œúœÊÐÈðÐËÐ¬ÒµÓÐÏÞ¹«ËŸ"£¬ÏÖœøÐÐÖØ×é£¬³É¹ŠŒæ²¢"œúœÊÐÊ¢ÒÚÐ¬³§"£¬ÏÖÖØÐÂÃüÃûÎª"œúœÊÐÊ¢ÒÚÏðœºÐ¬ÒµÓÐÏÞ¹«ËŸ",ÕâÒâÎ¶×ÅÎÒ¹«ËŸÒÑ³É¹ŠµØŽÓ"Ã³Ò×¹«ËŸ"Ïò"ÖÆÔìÉÌ"×ª±ä£¬ÎÒÃÇµÄ×ª±äÈôžøÄúŽúÀŽ²»±ã£¬ŸŽÇëÔÁÂ£¡Ï£ÍûÎÒÃÇµÄžÄ±äÓÐÀûÓÚÏà»¥Ö®ŒäµÄœøÒ»²œºÏ×÷£¡ ÈôÓÐÈÎºÎÒÉÎÊ£¬ÇëÓëÎÒÃÇÁªÏµ£¡ ÉÌÆí£¡ Contact person£ºMS.SALLY WANG & MR. MIKE Jinjiang Shengyi Shoes Co., Ltd. (Manufcturer) œúœÊÐÊ¢ÒÚÏðœºÐ¬ÒµÓÐÏÞ¹«ËŸ Add.: Gaoxia Industry Avenue, Qingyang Town, Jinjiang City, Fujian Province, China µØÖ·£ºÖÐ¹úž£œšÊ¡œúœÊÐÇàÑôžßÏŒ¹€ÒµÇø TEL: 86-595- 5626511 5626512 FAX: 86-595- 5626513 Email: r-start(a)163.com http://footwears.ebigchina.com

1 0

ADV-get ya gamble on!
by Rocco 26 Mar '02

26 Mar '02

1 0

limit read and write block sizes
by Jim Harm 25 Mar '02

25 Mar '02

We have very bad read times when using default rsize/wsize. There was some discussion about using smaller values. Can someone summarize why and what size to use? I thought it was a router or switch bug that was to be fixed. -- }}}===============>> LLNL James E. Harm (Jim); jharm(a)llnl.gov System Administrator Compaq Clusters (925) 422-4018 Page: 423-7705x57152

2 1

RE: mrtg and filers
by jwitham＠takedapharm.com 25 Mar '02

25 Mar '02

Depends mostly on what platform you want to run MRTG on.. Win32 or *nix. I've monitored the filers on both platforms, and had a much better run of setting it up on NT. Luckily (for me) you don't have to be an SNMP God to make MRTG work, you only really need to worry about the configuration files. The NOW site has some docs, but perhaps Mr. Ortega could share some of his .conf files as they appear to be quite flawless ;) John Witham Sr. Data Networking Engineer Takeda Pharmaceuticals North America, Inc. e://jwitham@takedapharm.com -----Original Message----- From: neil lehrer [mailto:nlehrer@ibb.gov] Sent: Thursday, March 21, 2002 1:02 PM To: toasters Subject: mrtg and filers hi, are there any docs around that discuss using mrtg with filers? i would like to monitor my filers, but am not snmp conversant. -- regards This message is for the designated recipient only and may contain privileged or confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

2 1

RE: mrtg and filers
by Manny Ortega 25 Mar '02

25 Mar '02

Yes... Just download the zip file from: http://people.ee.ethz.ch/~oetiker/webtool/mrtg/pub And follow the instructions... rateup.exe is part of the whole deal... -----Original Message----- From: neil lehrer [mailto:nlehrer@ibb.gov] Sent: Thursday, March 21, 2002 5:27 PM To: Manny Ortega; 'jwitham(a)takedapharm.com' Cc: toasters(a)mathworks.com Subject: Re: mrtg and filers thanks. i heard something about a rateup executable that is used. is that available|necessary for a winnt environment? -- regards +++++++++++++++++++++++++++++++++++++++++++++++++ + Neil Lehrer + + United States International Broadcasting Bureau + System Development Division + + voice 202 619-2524 + fax 202 619-3576 + nlehrer(a)ibb.gov + + " is this crisis an opportunity or just + another grab the fire extinguisher moment?" + +++++++++++++++++++++++++++++++++++++++++++++++++

2 1

refurbish filers
by Ali Maula Ali Mauli Ali DamDam 25 Mar '02

25 Mar '02

Hi guyz, ANybody selling refurbish toasters,pls contact me immediately... "Forgiveness is the fragrance that the flower leaves on the heel of the one that crushed it."--->Ali Maula Ali Mauli Ali DamDam --------------------------------- Do You Yahoo!? Yahoo! Movies - coverage of the 74th Academy Awards�

1 0

Accepting A Few More # B0F
by Ben Wilard 25 Mar '02

25 Mar '02

5BA9 WORK FROM HOME AND LOVE IT! This is your opportunity to finally BREAK OUT of the box and get control of your financial future.You deserve to: 1) Attain financial freedom 2) Control your own destiny 3) Work from your own home 4) Work your own schedule 5) Be your own boss If you CAN'T STAND the uncertainties of your present job, and you're serious, ACT NOW.WHAT ARE YOU WAITING FOR????? Please reply with the following information. FULL NAME: COMPLETE ADDRESS: EMAIL ADDRESS: PHONE: (Required; area code & number) BEST 2 TIMES TO CALL YOU TO: mailto:ddpa29@mail.com?subject=tell_me_more This message is sent in compliance of the new email bill section 301. Per Section 301, Paragraph (a)(2)(C) of S. 1618, further transmissions to you by the sender of this email will be stopped at no cost to you. This message is not intended for residents in the State of WA, NV, CA & VA. Screening of addresses has been done to the best of our technical ability. If you are a Washington, Virginia, or California resident please remove yourself. We respect all removal requests. //////////////////////////////////////////////////// Please remove at: mailto:p392km@yahoo.com?subject=remove ////////////////////////////////////////////////////

1 0

HP LTO
by Pramod S 23 Mar '02

23 Mar '02

Hi , I have an 880C running 6.1.1R2. I have an M1500 from Quantum with HP Ultrium LTO Drives. Since HP LTO is non-qualified, I have made an Entry in the /etc/cloned_tapes. But even after that, i still get an "non-qualified " when I run the sysconfig -t. If I do an mt -f <device> status, and then run the sysconfig -t command, it shows the devices correctly. But this lasts till I reboot the filer. After reboot I have to again do an mt -f <device> status, to see all the devices in sysconfig -t output. My /etc/cloned_tapes entry is HP Ultrium_1-SCSI EMULATES IBM ULTRIUM-TD1 Any suggestion on why this is happening?? Thanks, Pramod

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters