Monitoring Cisco UCS C-Series Integrated Management Controllerusing SyslogFirst Published: 2018-08-31

Americas HeadquartersCisco Systems, Inc.170 West Tasman DriveSan Jose, CA 95134-1706USAhttp://www.cisco.comTel: 408 526-4000

800 553-NETS (6387)Fax: 408 527-0883

© 2018 Cisco Systems, Inc. All rights reserved.

C O N T E N T S

Preface vP R E F A C E

Audience v

Conventions v

Related Cisco UCS Documentation vii

Introduction to Syslog Messages 1C H A P T E R 1

Syslog Messages 1

UCS C-Series Message Severity Terms and Codes 1

Cisco IMC Fault Types 3

Syslog Message Example and Format 4

Configuring Syslog in Cisco IMC 5C H A P T E R 2

Syslog Configuration 5

Configuring Syslog Using Cisco IMC GUI 5

Configuring Syslog Using the Cisco IMC CLI 6

Monitoring Cisco IMC using Syslog 9C H A P T E R 3

Monitoring Syslog Messages 9

Syslog Messages to Monitor 9

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslogiii

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslogiv

Contents

Preface

• Audience, on page v• Conventions, on page v• Related Cisco UCS Documentation, on page vii

AudienceThis guide is intended primarily for data center administrators with responsibilities and expertise in one ormore of the following:

• Server administration

• Storage administration

• Network administration

• Network security

ConventionsIndicationText Type

GUI elements such as tab titles, area names, and field labels appear in this font.

Main titles such as window, dialog box, and wizard titles appear in this font.

GUI elements

Document titles appear in this font.Document titles

In a Text-based User Interface, text the system displays appears in this font.TUI elements

Terminal sessions and information that the system displays appear in thisfont.

System output

CLI command keywords appear in this font.

Variables in a CLI command appear in this font.

CLI commands

Elements in square brackets are optional.[ ]

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslogv

IndicationText Type

Required alternative keywords are grouped in braces and separated by verticalbars.

{x | y | z}

Optional alternative keywords are grouped in brackets and separated by verticalbars.

[x | y | z]

A nonquoted set of characters. Do not use quotation marks around the string orthe string will include the quotation marks.

string

Nonprinting characters such as passwords are in angle brackets.< >

Default responses to system prompts are in square brackets.[ ]

An exclamation point (!) or a pound sign (#) at the beginning of a line of codeindicates a comment line.

!, #

Means reader take note. Notes contain helpful suggestions or references to material not covered in thedocument.

Note

Means the following information will help you solve a problem. The tips information might not betroubleshooting or even an action, but could be useful information, similar to a Timesaver.

Tip

Means the described action saves time. You can save time by performing the action described in the paragraph.Timesaver

Means reader be careful. In this situation, you might perform an action that could result in equipment damageor loss of data.

Caution

IMPORTANT SAFETY INSTRUCTIONS

This warning symbol means danger. You are in a situation that could cause bodily injury. Before you workon any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standardpractices for preventing accidents. Use the statement number provided at the end of each warning to locateits translation in the translated safety warnings that accompanied this device.

SAVE THESE INSTRUCTIONS

Warning

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslogvi

PrefacePreface

Related Cisco UCS DocumentationDocumentation Roadmaps

For a complete list of all B-Series documentation, see theCiscoUCS B-Series Servers Documentation Roadmapavailable at the following URL: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/overview/guide/UCS_roadmap.html

For a complete list of all C-Series documentation, see theCiscoUCSC-Series Servers Documentation Roadmapavailable at the following URL: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/overview/guide/UCS_rack_roadmap.html.

For information on supported firmware versions and supported UCS Manager versions for the rack serversthat are integrated with the UCS Manager for management, refer to Release Bundle Contents for Cisco UCSSoftware.

Other Documentation Resources

Follow Cisco UCS Docs on Twitter to receive document update notifications.

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslogvii

PrefaceRelated Cisco UCS Documentation

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslogviii

PrefaceRelated Cisco UCS Documentation

C H A P T E R 1Introduction to Syslog Messages

This chapter includes the following sections:

• Syslog Messages, on page 1• UCS C-Series Message Severity Terms and Codes, on page 1• Cisco IMC Fault Types, on page 3• Syslog Message Example and Format, on page 4

Syslog MessagesCisco Integrated Management Controller (Cisco IMC) generates system log, or syslog, messages to recordthe following incidents that take place in the UCS C-Series servers:

• Routine system operations

• Failures and errors

• Critical and emergency conditions

There are three kinds of syslog entries:

• Faults

• Events

• Audit logs

Each syslog message identifies the Cisco IMC process that generated the message and provides a briefdescription of the operation or error that occurred.

UCS C-Series Message Severity Terms and CodesCisco IMC labels each log entry with a severity term. The following table compares the UCSC-Series severityterm label for a log entry to the severity term label displayed in the syslog in Cisco IMC:

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog1

Table 1: Severity Terms

Syslog LevelCisco IMC Severity

infoinfo

notificationwarning

warningsminor

errormajor

criticalcrtical

The following table contains the Cisco IMC message severity codes and their descriptions. Severity codescan be used to create filters for monitoring syslog messages.

Table 2: Severity Codes

DescriptionKeywordSeverityCode

Emergency messages indicate that the system isunusable. A panic condition usually affectsmultiple applications, servers, or sites. Emergencymessages can be set to notify all technical staffmembers who are on call.

emerg (panic)Emergency0

Alert messages indicate that action must be takenimmediately; staff members who can fix theproblem must be notified. An example of an alertmessage would be the loss of a primary ISPconnection.

alertAlert1

Critical messages indicate conditions that shouldbe corrected immediately, and also indicate failurein a secondary system. An example of a criticalmessage would be the loss of a backup ISPconnection.

critCritical2

Error messages indicate non-urgent failures. Errormessages should be relayed to developers ornetwork administrators, and must be resolvedwithin a specific timeframe.

errError3

Warning messages indicate that that an error willoccur if action is not taken, for example, the filesystem is 85% full. Warnings faults also must beresolved within a specific timeframe.

warning (warn)Warning4

Notice messages indicate events that are unusualbut that are not error conditions. They can besummarized in an email to developers oradministrators to spot potential problems, but noimmediate action is necessary.

noticeNotice5

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog2

Introduction to Syslog MessagesUCS C-Series Message Severity Terms and Codes

DescriptionKeywordSeverityCode

Informational messages are associatedwith normaloperational behavior. They may be tracked forreporting, measuring throughput, or other purposes,but no action is required.

infoInformational6

Debug messages are useful to developers fordebugging the application, but are not useful fortracking operations.

debugDebug7

Cisco IMC Fault TypesThe table below defines the fault types that are available in Cisco IMC, and their usefulness for monitoringpurposes:

Table 3: Fault Types in Cisco IMC

MonitoringDescriptionType

These faults are essential forservice monitoring.

Cisco IMC has detected that a physical component isinoperable or has another functional issue.

equipment

These faults are raised duringserver provisioning or serviceprofile association.

Cisco IMC is unable to complete a server task, such asassociating a service profile with a server.

server

These faults are essential forservice monitoring.

Cisco IMC is unable to successfully configure acomponent.

configuration

These faults are essential forservice monitoring.

Cisco IMC has detected a power problem, thermalproblem, voltage problem, or loss of CMOS settings.

environment

These faults are essential forservice monitoring.

Cisco IMC has detected a serious management issue,such as one of the following:

• Critical services cannot be started.

• The primary switch cannot be identified.

• A software service has become unresponsive.

• Components in the instance include incompatiblefirmware versions.

management

These faults are essential forservice monitoring.

Cisco IMC has detected a connectivity problem, suchas an unreachable adapter.

connectivity

These faults are essential forservice monitoring.

Cisco IMC has detected a network issue, such as a linkdown.

network

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog3

Introduction to Syslog MessagesCisco IMC Fault Types

MonitoringDescriptionType

These faults do not havesignificant value for remotemonitoring.

Cisco IMC has detected an operational issue, such asone of the following:

• A log data store has reached its maximum capacity.

• Files cannot be transferred.

• A server discovery failed.

operational

Syslog Message Example and FormatThe following string is an example of a typical Coisco IMC syslog message:

Apr 19 17:11:12 UTC: %CIMC-6-LOG_CAPACITY:[F0461][info][log-capacity][sys/rack-unit-1/mgmt/log-SEL-0] Log capacity on Management Controller onserver 1/7 is very-low

The following table lists the Syslog message parts and provides the definition of each part:

DefinitionMessage PartSyslog Message

Provides the date and the time, in UTC format, and indicateswhen the event or fault occurred.

Date and TimeApr 19 17:11:12UTC

Refers to the message source. The message source is usually ahardware device, a protocol, or a module of the system software.

Facility is Cisco-specific and is only relevant withinthe message string. It is different from facility asdefined in RFC 3164 for the syslog protocol. Formessages originating from Cisco IMC, the facilitywill always be %CIMC.

Note

Facility%CIMC

Refers to the syslog severity code.Severity6

A device-specific code that uniquely identifies the message, andmaps to a fault type in Cisco IMC.

MnemonicLOG_CAPACITY

A unique identifier assigned to the fault.ID[F0461]

In this example, a basic notification or informational message,possibly independently insignificant.

Cisco IMC Severity[info]

A device-specific code that uniquely identifies the message andmaps to the fault type in Cisco IMC.

Mnemonic[log-capacity]

The specific Cisco UCS device in which the fault occurred.System[sys/rack-unit-1/mgmt/log-SEL-0]

A brief description of the fault.DescriptionSystem Event logcapacity is very low

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog4

Introduction to Syslog MessagesSyslog Message Example and Format

C H A P T E R 2Configuring Syslog in Cisco IMC

This chapter contains the following sections:

• Syslog Configuration, on page 5• Configuring Syslog Using Cisco IMC GUI, on page 5• Configuring Syslog Using the Cisco IMC CLI, on page 6

Syslog ConfigurationYou can configure syslog in Cisco IMC using both Cisco IMC GUI and the Cisco IMC CLI.

Configuring Syslog Using Cisco IMC GUI

Step 1 In the Navigation pane, click the Chassis menu.Step 2 In the Chassis menu, click Faults and Logs.Step 3 In the Logging Controls tab, enter the following information:

Remote Logging

DescriptionName

If checked, the Cisco IMC sends log messages to the Syslog server named inthe IP Address field.

Enabled check box

The address of the Syslog server on which the Cisco IMC log should be stored.You can set an IPv4 or IPv6 address or a domain name as the remote systemaddress.

Host Name/IP Address field

Enter a destination port number of the Syslog server within the range 1 to 65535.The default port number is 514.

Port field

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog5

DescriptionName

Specify the lowest level of messages that will be included in the remote logs.You can select one of the following:

• Emergency

• Alert

• Critical

• Error

• Warning

• Notice

• Informational

• Debug

Minimum Severity to Report field

The Cisco IMC does not remotely log any messages with a severity below the selected severity. For example,if you select Error, then the Cisco IMC remote log contains all messages with the severity Emergency, Alert,Critical, or Error. It does not showWarning, Notice, Informational, or Debug messages.

Note

Local Logging

This area displays only theMinimum Severity to Report drop-down list as shown in the table above. You can specifythe lowest level of messages to be included in the local log

Configuring Syslog Using the Cisco IMC CLIYou can configure profiles for one or two remote syslog servers to receive Cisco IMC log entries.

Before you begin

• The remote syslog server must be configured to receive logs from a remote host.

• The remote syslog server must be configured to receive all types of logs, including authentication-relatedlogs.

• The remote syslog server's firewall must be configured to allow syslog messages to reach the syslogserver.

Procedure

PurposeCommand or Action

Enters the Cisco IMC command mode.Server# scope cimcStep 1

Enters the Cisco IMC log command mode.Server /cimc # scope logStep 2

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog6

Configuring Syslog in Cisco IMCConfiguring Syslog Using the Cisco IMC CLI

PurposeCommand or Action

The severity level can be one of the following, in decreasingorder of severity:

(Optional) Server /cimc/log # set remote-syslog-severitylevel

Step 3

• emergency

• alert

• critical

• error

• warning

• notice

• informational

• debug

Cisco IMC does not remotely log any messageswith a severity below the selected severity. Forexample, if you select error, then the remotesyslog server will receive all Cisco IMC logmessages with the severity Emergency, Alert,Critical, or Error. It will not show Warning,Notice, Informational, or Debug messages.

Note

Selects one of the two remote syslog server profiles andenters the command mode for configuring the profile.

Server /cimc/log # scope server {1 | 2}Step 4

Specifies the remote syslog server address.Server /cimc/log/server # set server-ip ipv4 or ipv6 addressor domain name

Step 5

You can set an IPv4 or IPv6 address or a domainname as the remote server address.

Note

Sets the destination port number of the remote syslog server.Server /cimc/log/server # set server-port port numberStep 6

Enables the sending of Cisco IMC log entries to this syslogserver.

Server /cimc/log/server # set enabled {yes | no}Step 7

Commits the transaction to the system configuration.Server /cimc/log/server # commitStep 8

Example

This example shows how to configure a remote syslog server profile and enable the sending of CiscoIMC log entries with a minimum severity level of Warning:Server# scope cimcServer /cimc # scope logServer /cimc/log # set remote-syslog-severity warningServer /cimc/log *# scope server 1Server /cimc/log/server *# set server-ip www.abc.comServer /cimc/log/server *# set server-port 514Server /cimc/log/server *# set protocol udp

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog7

Configuring Syslog in Cisco IMCConfiguring Syslog Using the Cisco IMC CLI

Server /cimc/log/server *# set enabled yesServer /cimc/log/server *# commitServer /cimc/log/server # exitServer /cimc/log # show serverSyslog Server 1:

Syslog Server Address: www.abc.comSyslog Server Port: 514Enabled: yes

Server /cimc/log # show remote-syslog-severityRemote Syslog Severity: warning

Server /cimc/log #

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog8

Configuring Syslog in Cisco IMCConfiguring Syslog Using the Cisco IMC CLI

C H A P T E R 3Monitoring Cisco IMC using Syslog

This chapter contains the following sections:

• Monitoring Syslog Messages, on page 9• Syslog Messages to Monitor, on page 9

Monitoring Syslog MessagesSyslog messages contain the event code and fault code. To monitor syslog messages, you can define syslogmessage filters. The filters can parse the syslog messages based on the criteria you choose. You can use thefollowing criteria to define a filter:

• By event or fault codes: Define a filter with a parsing rule to include only the specific codes that youintend to monitor. All messages that do not match these criteria will be discarded.

• By severity level: Define a filter with a parsing rule to monitor syslog messages with specific severitylevels.

Syslog Messages to MonitorThe table below lists some syslog messages that you may want to monitor in Cisco IMC:

Fault Code and DescriptionFault TypeFailure

F0185 - DIMM [id]/[id] on server [serverid] operability:[operability]

equipmentDIMM problems

F0313 - [Serverid] BIOS failed power-on self testServer[chassisId] BIOS failed power-on self test.

F0374 - Power supply [id] in [serverid] operability:[operability]

F0376 - IOCard [location] on [serverId] is removed.

equipmentEquipment failures

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog9

Fault Code and DescriptionFault TypeFailure

F0176/F0177 - Processor [id] on [serverid]temperature:[thermal]

F0187/F0188 - DIMM [location] on [serverid] temperature:[thermal]

F0379 - IOCard [location] on server [id] operState:[operState]

F0382/F0384 - Fan module [tray]-[id] in [serverid]temperature: [thermal]

F0383/F0385 - Power supply [id] in [serverid] temperature:[thermal]

F0409/F0411 - Thermal condition on [serverid] cause:[thermalStateQualifier]

F0539/F0540 - IOHub on [serverId] temperature: [thermal]

environmentThermal problems

F0179/F0180 - Processor [id] on [serverId] voltage:[voltage]

F0190/F0191 - Memory array [id] on [serverid] voltage:[voltage]

F0389/F0391 - Power supply [id] in [serverid] voltage:[voltage]

F0425 - CMOS battery voltage on [serverid] is[cmosVoltage]

environmentVoltage problems

F0310 - Motherboard of [serverid] power: [operPower]environmentPower problems

Monitoring Cisco UCS C-Series Integrated Management Controller using Syslog10

Monitoring Cisco IMC using SyslogSyslog Messages to Monitor