Solstice Enterprise Manager 4.1 Managing Your Network

Chapter 11

Examining Log Entries

By using Solstice Enterprise Manager (Solstice EM) Log Entries tool, you can browse the contents of log files and view the details of log entries. Log Entries gives you detailed information on events that have occurred on your network. Log files and log entries are an important network management tool, particularly in the areas of configuration, alarm, and security management.

This chapter comprises the following topics:

• Section 11.2 Getting Started With Log Entries
• Section 11.3 Changing the Log Entry Display
• Section 11.4 Viewing Log Entry Details
• Section 11.5 Filtering Log Entries
• Section 11.6 Combining Log Entries in a Single View
• Section 11.7 Searching for Log Entries
• Section 11.8 Printing and Deleting Log Entries
• Section 11.9 Adding and Removing Solstice EM Tools

11.1 Overview

Log files are software entities that collect data of events that occurred on your network. Agents that monitor the network components create event notifications when they detect a change in the state of a managed resource. When such event notifications arrive at the MIS, a filtering test--called a discriminator construct--is performed on the event notification to determine whether or not to discard it. If the event notification passes the filtering test, Solstice EM writes the event notification in the designated log file.

The Solstice EM installation provides you with the AlarmLog file. This default log file may be sufficient for your needs. If not, Solstice EM's Event Logs tool enables you to create any number of log files to meet your specific needs. Depending on your Solstice EM configuration, you may have more than one log file. Using Log Entries, you can examine the log entries file by file, or you can combine the log records in a single view. No log size limitation forces old records to be removed.

See the Customizing Guide for more information about using Event Logs to create log files and about log attributes.

11.1.1 Log Entries in the AlarmLog File

By default, the AlarmLog will record the following events:

• SNMP trap notifications (alarms forwarded from remote SNM managers by Cooperative Consoles)
• Nerve Center alarms
• OSI standard alarms

The following events and attributes are, by default, explicitly excluded from AlarmLog:

• SNM event notifications generated by SNM RPC agents
• attributeValueChange
• objectCreation
• objectDeletion
• stateChange

If you wish to view SNM RPC event notifications plus the above event attributes, you should create log files using Solstice EM's Event Logs tool.

Although the log records and the attributes you see in the Log Entry window depend upon what was specified during the creation of the log files using the Event Logs tool, Log Entries enables you to specify display and filtering properties to facilitate the examination of log entries.

11.1.2 Related Files

The .em_logview.cf configuration file - The Log Entries configuration file in your home directory or in the $EM_HOME/config directory.

11.1.3 Related Tasks

• Chapter 5 in the Customizing Guide
• Chapter 5 "Managing Alarms""
• Chapter 6 "Controlling User Access"

11.1.4 Further Reading

See the Customizing Guide and C++ API Reference for related information.

11.2 Getting Started With Log Entries

All operations pertaining to viewing log records are performed in the Log Entries window which displays when you start Solstice EM's Log Entries tool.

You start the Log Entries tool from any of the following places:

• Network Views window
• Network Tools window
• Event Log window
• The operating system command line.

If Solstice EM Security has been enabled, your access privileges determine your ability to run Log Entries, look at log entry data, and purge the log files. See Chapter 6 Controlling User Access" for more information on defining user access.

To Use Log Entries

1. Start Log Entries in one of the following ways

• From the Network Views window, click Tools->Log Entries.
• From the Network Tools window, click Log Entries.
• From the Event Logs window, click Tools->Log Entries, or double-click a specific log.
• From an operating system prompt, enter the following command: em_logview.

  See Section11.10.1.1 The em_logview Command to ensure the configuration settings are correct.

2. Perform any of the tasks discussed in this chapter.

3. Click File->Exit.

See Also:

• Command Line Options
• Chapter 5 in the Customizing Guide

11.3 Changing the Log Entry Display

You can customize the way you view log records in the Log Entry window. By default, the Log Entry window shows the log records sorted by log record number, and identifies them by the following attributes:

• Event type
• Date at which the events were recorded in the log file
• Agent that sent the event

Solstice EM enables you to customize the default view to suit your personal needs and preferences, such as:

• Including and excluding log entry attributes from the display
• Changing the column order
• Organizing the order in which log entries are shown
• Customizing the column labels in the Log Entries window

These viewing properties can be set individually or all at once.

To Include and Exclude Log Entry Attributes

1. Click View->Column Headings to display the Column Headings dialog.

Hidden Attributes lists the log entry attributes not currently shown in the Log Entry window, while Shown Attributes lists the attributes displayed in the window.

2. Proceed as follows:

• To exclude attributes from the window display, select one or several attributes in Shown Attributes and click Hide.
• To include attributes not currently shown, select one or several attributes in Hidden Attributes and click Show.

3. Click OK.

To Change the Column Order

1. Click View->Column Headings to display the Column Headings dialog.

2. In Shown Attributes, select the attribute you wish to be shown as the first column from the left and click either Move Up or Move Down so that it is in first position.

3. Select the attribute you wish to be shown as the second column and, again, click Move Up or Move Down until it is in second position.

4. Repeat steps 2 or 3 as necessary.

5. Click OK.

To Organize the Sort Order of Log Entries

1. Click View->Column Headings to display the Column Headings dialog.

2. Click Sort Order to display the Sort Order dialog.

3. Define the attributes that should be used for the sort order:

• To remove attributes, select them in Sort Order and click Remove.
• To include attributes, select them in All Attributes and click Add.

  The Sort Order box now lists all the attributes to be included in the sort order.

4. Specify the priority of the sort order:

1. In the Sort Order box, select the first attribute and click Move Up or Move Down.
2. Still in Sort Order, select the second attribute and click Move Up or Move Down.
3. Repeat as often as necessary.
4. Click OK to return to the Column Headings dialog.

5. Click OK.

To Customize the Column Labels

1. Click View->Column Headings to display the Column Headings dialog.

2. In Display Column Headings, select User Defined Headings, and click Edit Names to display the Edit Names dialog.

Default Name shows the current label names of the columns.

3. In User Defined Name, type the new column name.

4. Click OK to return to the Column Headings dialog.

5. Click OK.

11.4 Viewing Log Entry Details

By default, the Log Entry window comes up in its basic form, showing only a minimum of log record details. The window can be expanded to reveal all attribute values pertaining to a specific log entry.

To View Log Entry Details

1. Select a log entry in the main window and click Record Details.

2. Move the sash up or down to reveal more or less of the log entry details.

FIGURE 11-1   Controls for Viewing Details of Log Entries

11.5 Filtering Log Entries

Log files typically contain a lot of log entries which makes viewing the records a cumbersome effort. Solstice EM enables you to temporarily remove log entries from the Log Entry window display so that you can concentrate on those of interest.

You can filter log entries based on the following:

• Object instances
• Object classes
• Event types
• Alarms

When setting filter criteria, before you exit the Filter dialog, you can save filter criteria to a file. Saved filter criteria can then be reused whenever necessary. You can also print the filter criteria to a file or to a printer.

To Filter Log Entries

1. Click View->Filter Properties to display the Log Filter dialog.

2. Click the Include list box to reveal the filter options, and select a filter option.

3. Click Apply.

4. (Optional) Click Save to Save the current filter criteria.

5. (Optional) Click load to reuse a previously saved filter file and apply the criteria to the current display.

6. (Optional) Click Print to print the current filter criteria.

7. When done, click OK.

11.6 Combining Log Entries in a Single View

When looking at log entries, you can examine the log entries from individual log files, or merge the log entries from several log files into one single view, as if the log entries were recorded in one file. When log entries from several log files are combined into a single you, you then use filter criteria to remove certain log entries temporarily from the display to facilitate your examination of the log entries.

To Combine Log Entries in a Single View

1. Click View->Log Selection to open the Log Selection dialog.

See Section11.5 Filtering Log Entries for more information about the dialog options.

2. Proceed as follows:

• To add log entries from available log files, in Available Logs select the log file and click Display.
• To remove log entries from open log files, in Available Logs select the log file and click Remove.

3. Click OK.

See Also Filtering Log Entries

11.7 Searching for Log Entries

Solstice EM provides you with a search mechanism to quickly find the log entries of interest.

The case-sensitive text string you type must match in whole or in part any of the attributes shown in the Log Entry window. For example, you are looking for records pertaining to changes in attribute values recorded by attributeValueChange. If you type ValueChange, Value or Change, Solstice EM will find any log entries that reported changes in attribute values. However, if you type value change (lowercase characters and space between the words), value or change, Solstice EM will not find the log entries and display a "Text not found" message. Other strings can be any number, for example, 95.

To Search for Log Entries

1. Click Actions->Find to display the Find dialog.

2. In Find Text, type the case-sensitive text string to be used for searching.

3. Start the search as follows:

• Click Find to start a forward search.
• Click Find again to continue the forward search.
• Click Previous to change the search direction and find the previous log entry.

4. Click Close.

11.8 Printing and Deleting Log Entries

Delete log entries when you have finished examining them. Remember that you can always keep a record of the log entries by printing them or saving them to a file. Solstice EM will remove any data of the deleted log entries from the log file in the MIS.

To Print Log Entries

1. Select one or more log entries in the Log Entries window.

2. To look at the log entry details of selected log entries, click Record Details to expand the Log Entries window.

3. Click Print to display a Print dialog.

4. Choose to print to a file or to a printer.

5. Click Print.

To Delete Log Entries

---

Caution – Deleted log entries cannot be retrieved from the MIS.

---

1. Select one or more log entries in the Log Entries window.

2. Select Actions->Delete.

11.9 Adding and Removing Solstice EM Tools

Solstice EM enables you to add to the Tools menu any tools and other custom-developed applications that you either use frequently with Log Entries, or to which you wish to have quick access from any Solstice EM tool. At any point in time you can remove any tools added to the Tools menu.

Step-by-step procedures for adding and removing tools to the Tools menu follow.

To Add Tools to the Tools Menu

1. Click File -> Customize Tools Menu to display the Log Entries Customize Tools Menu dialog.

2. In Application Name, type a name that will enable you to recognize the tool, such as the name of the tool's executable or its commercial name.

For example, em_logview or Log Entries tool.

3. In Path To Executable, type the path name of the tool's executable file.

The default is /opt/SUNWconn/em/bin/em_logview.

4. In Arguments, type any desired command variables associated with and recognized by the tool's executable.

5. Click Add.

The tool's name is added to the list of tools at the top of the dialog.

6. Click OK.

To Remove Tools From the Tools Menu

1. Click File->Customize Tools Menu to display the Log Entries Customize Tools Menu dialog.

2. In Applications at the top of the dialog, select the tool you want to remove.

3. Click Delete.

4. Click OK.

11.10 Reference

This section provides technical reference information about command-line options for log entry operations.

For detailed information about dialogs, menus, and other user interface elements, refer to the Solstice EM Online Help. To access Online Help, click the Help button on any dialog box or select options from the Help menu located in the upper right corner of each Solstice EM tool window.

11.10.1 Command Line Options

Reference information is available for the following:

• The em_logview Command-page 11-11
• The em_nnconfig Utility-page 11-11

11.10.1.1 The em_logview Command

The em_logview command is the executable to start the Log Entries tool. Before you start Log Entries from the command line, make sure the $XFILESEARHPATH environment variable is set. If you installed Solstice EM in the default location, it should point to /opt/SUNWconn/em/config. If this environment variable is not set, the fonts, colors, and backgrounds may not display correctly.

The command syntax is: em_logview [options]

The following table describes the command options.

TABLE 11-1   em_logview Command Options 

Option	Description
-help	Print a descriptive list of command options for the em_logview command.
-host hostname	Specify the name of a remote MIS server. For example: em_logview -host omega. Instead of a host name, you can specify an IP address as the host name. For example: em_logview -host 123.345.678.900.
-c filename	Specify the file name of the configuration file. For example: em_logview -c .em_mylogview.cf.
-logobj fdn	Display the log records of the specified log file in the main window summary table. For example: em_logview snmp_router_log

11.10.1.2 The em_nnconfig Utility

The em_nnconfig utility enables you to create and map nicknames to an object's Full Distinguished Name.

See Chapter 4 of the Developing C++ Applications Guide for related information.

11.10.1.3 Log Entries Configuration File

Upon start-up, the Log Entries tool looks for the .em_logview.cf configuration file in your home directory; otherwise, it looks for the em_logview.cf configuration file in the $EM_HOME/config directory. If the configuration file is not found, Log Entries uses the default properties.

The alphanumeric characters in each line of the configuration file must begin at the left edge. Each statement must be on a separate line. The configuration file has the following format.

display_name=fdn label_name=default_name show_doc_names=show show_oids=oid attr_name=logRecordId logRecordId.name=Record # logRecordId.position=1 logRecordId.displayed=true logRecordId.width=7 attr_name=eventTime eventTime.name=Event Time eventTime.position=2 eventTime.displayed=true eventTime.width=11 attr_name=eventType eventType.position=3 eventType.displayed=true eventType.width=14 attr_name=managedObjectClass managedObjectClass.name=Class managedObjectClass.position=4 managedObjectClass.displayed=true managedObjectClass.width=12 attr_name=managedObjectInstance managedObjectInstance.name=Instance managedObjectInstance.position=5 managedObjectInstance.displayed=true managedObjectInstance.wdith=45

The information in this file corresponds to the selections made in the Column Headings and Log Filter dialogs.