topic Re: How to get Events older than 2 days? in ONTAP Discussions

How to get Events older than 2 days?

chris_hague — Wed, 06 Jul 2016 08:35:41 GMT

Our SNMP monitoring picked up a health alert last week and I am trying to find out what it was, but when I do an event log show it only goes back 2 days.

I've also tried enabling web access to logs folder using;

security login role create -vserver <cluster_vserver> -role rsa -cmddirname DEFAULT -access all
security login create -vserver <cluster_vserver> -username rsauser -application http -authmethod password -role rsa
security login create -vserver <cluster_vserver> -username rsauser -application ontapi -authmethod password -role rsa
vserver services web modify -vserver * -enabled true -name spi|ontapi|compat
vserver services web access create -name spi -role rsa -vserver <cluster_vserver>
vserver services web access create -name ontapi -role rsa -vserver <cluster_vserver>
vserver services web access create -name compat -role rsa -vserver <cluster_vserver>
vserver services web access create -name spi -role admin -vserver <cluster_vserver>

SP on each controller> rsa setup # runs rsa test at end
Test Web Browser Access to Logs
• log files (http:// or https://) https://cluster-mgmt-ip/spi/node-name/etc/log/
• core dump files (http:// or https://) https://cluster-mgmt-ip/spi/node-name/etc/crash/

But this asks me to log in, then gives a 404 error.

Re: How to get Events older than 2 days?

georgevj — Fri, 08 Jul 2016 05:02:20 GMT

Please tell us the Data ONTAP version and the Hardware model.

Re: How to get Events older than 2 days?

chris_hague — Fri, 08 Jul 2016 09:18:12 GMT

It's a FAS2552 on CDOT 8.3.1RC1

Re: How to get Events older than 2 days?

georgevj — Fri, 08 Jul 2016 09:28:10 GMT

In 8.3, the SPI access is configured by default.Try opening the url https://cluster-mgmt-ip/spi/ and login as "admin" to check if its working. If not, we need to take a detailed look at the steps you performed.

Re: How to get Events older than 2 days?

chris_hague — Fri, 08 Jul 2016 09:33:58 GMT

Hello, Thanks...

I do get a "Root Volume File Access" page if I go to the /spi/ link. However clicking on logs brings a page cannot be displayed error.

Re: How to get Events older than 2 days?

chris_hague — Fri, 08 Jul 2016 12:58:38 GMT

Seems the client windows machine didnt have access to the IP address on the default node mgmt ip.

Clicking advanced has allowed me to connect to another mgmt ip in an accessible VLAN

Re: How to get Events older than 2 days?

MARCALEXANDRE — Fri, 14 Oct 2016 07:42:13 GMT

Hi,

I have the same problem. I can't get events older than 2-3 days. I can acces to the SPI using web browser:

https://cluster-mgmt-ip/spi/node-mgmt-ip/log/. But which files contains the events log?

I try the files messages, but I don't have the same output than "event log show command".

Regards,

Marc

Re: How to get Events older than 2 days?

axsys — Tue, 20 Dec 2016 08:44:12 GMT

BUMP to what Marcalexander said. I checked ems file which is pretty much unreadable via spi and rdfile on the node ... as well as all messages files which are empty. I only have less then 24hours in the event log... where can I find older logs?

Thank you,

axsys

Re: How to get Events older than 2 days?

chris_hague — Fri, 06 Jan 2017 15:22:31 GMT

Notepad++ is essential to read the logs from the SPI. Normal notepad doesn't format them correctly.

Is that what you meant?

Re: How to get Events older than 2 days?

shead2 — Fri, 14 Dec 2018 21:27:40 GMT

No one answered whether it is possible to locate historical logs on CDOT? Two days worth is not far enough. Today is Dec 14th and I am searching for logs from Dec 8th? How long are logs kept? 4000 entry limit is not adequate.