How to get Events older than 2 days?

[chris_hague]

Our SNMP monitoring picked up a health alert last week and I am trying to find out what it was, but when I do an event log show it only goes back 2 days.

I've also tried enabling web access to logs folder using;

security login role create -vserver <cluster_vserver> -role rsa -cmddirname DEFAULT -access all
security login create -vserver <cluster_vserver> -username rsauser -application http -authmethod password -role rsa
security login create -vserver <cluster_vserver> -username rsauser -application ontapi -authmethod password -role rsa
vserver services web modify -vserver * -enabled true -name spi|ontapi|compat
vserver services web access create -name spi -role rsa -vserver <cluster_vserver>
vserver services web access create -name ontapi -role rsa -vserver <cluster_vserver>
vserver services web access create -name compat -role rsa -vserver <cluster_vserver>
vserver services web access create -name spi -role admin -vserver <cluster_vserver>

SP on each controller> rsa setup # runs rsa test at end
Test Web Browser Access to Logs
• log files (http:// or https://) https://cluster-mgmt-ip/spi/node-name/etc/log/
• core dump files (http:// or https://) https://cluster-mgmt-ip/spi/node-name/etc/crash/

But this asks me to log in, then gives a 404 error.

[georgevj]

Please tell us the Data ONTAP version and the Hardware model.

[chris_hague]

It's a FAS2552 on CDOT 8.3.1RC1

[georgevj · Accepted solution]

In 8.3, the SPI access is configured by default.Try opening the url https://cluster-mgmt-ip/spi/ and login as "admin"  to check if its working. If not, we need to take a detailed look at the steps you performed.

[chris_hague]

Hello, Thanks...

I do get a "Root Volume File Access" page if I go to the /spi/ link. However clicking on logs brings a page cannot be displayed error.

[chris_hague]

Seems the client windows machine didnt have access to the IP address on the default node mgmt ip.

Clicking advanced has allowed me to connect to another mgmt ip in an accessible VLAN

 

[MARCALEXANDRE]

Hi,

I have the same problem. I can't get events older than 2-3 days. I can acces to the SPI using web browser:

 https://cluster-mgmt-ip/spi/node-mgmt-ip/log/. But which files contains the events log?

I try the files messages, but I don't have the same output than "event log show command".

Regards,

Marc

[axsys]

BUMP to what Marcalexander said. I checked ems file which is pretty much unreadable via spi and rdfile on the node ... as well as all messages files which are empty. I only have less then 24hours in the event log... where can I find older logs?

Thank you,

axsys

[chris_hague]

Notepad++ is essential to read the logs from the SPI. Normal notepad doesn't format them correctly.

Is that what you meant?

[shead2]

No one answered whether it is possible to locate historical logs  on CDOT?  Two days worth is not far enough.  Today is Dec 14th and I am searching for logs from Dec 8th?  How long are logs kept?  4000 entry limit is not adequate.