Manage Log Entries (system, event, audit, session)

Before You Begin

The top-level System Log presents a subset of relevant operational Event Log entries in a more simplified manner. Specifically this log reports subsystem level diagnostic events pertaining to system inventory actions and component health status. These events can include power on and off, FRU insert and removal, as well as status events, such as service required, warning, or OK.
The Event Log tracks informational, warning, or error messages about a managed device such as the addition or removal of a component or the failure of a component. The properties of the events recorded in the log can include: the severity of the event, the event provider (class), and the date and time the event was logged.
The Audit Log and Session Log tracks all interface-related user actions such as, user logins, logouts, configuration changes, and password changes. The user interfaces monitored for user actions include the Oracle ILOM web interface, CLI, Fault Management shell (captive shell), and Restricted shell, as well as the API , SNMP, and IPMI client interfaces.

Note:
As of Oracle ILOM firmware version 5.1.0, user session login and logout events for all Oracle ILOM user interfaces (web, CLI, and API ) have been moved from the audit log to the session log.

Note:
User login and logout events captured in the audit log prior to Oracle ILOM 5.1.0 will continue to remain in the audit log.
You need Admin (a) role privileges to clear log entries in Oracle ILOM.

Note:

Oracle ILOM uses UTC/GMT time zones, by default, when capturing timestamps for log entries.

To manage Oracle ILOM log entries, perform one of the following procedures.

Manage Oracle ILOM log entries – Web Procedure 1
Manage Oracle ILOM log entries – CLI Procedure 2

Manage Oracle ILOM log entries – Web Procedure
1. Perform one of the following:
  - To view the system log entries in the SP web interface, click ILOM System Information > System Log.
  - To view the event or audit log entries in the SP web interface, click ILOM Administration > Logs, then click Event or Audit or Session.
2. To filter the event types shown or to control the display properties for rows and pages, use the controls at the top of the log table.
  
  For further information about filtering log properties, click the More Info link appearing on the log page.
3. To clear all log entries shown in the table, click Clear Log.
  
  A confirmation dialog appears. In the confirmation dialog, click OK to clear the entries.
Manage Oracle ILOM log entries – CLI Procedure
1. To list log entries from the SP CLI, perform one of the following.
  - For the system log, type,:
    
    show /System/Logs/list
  - For the event log, type:
    
    show /SP/Logs/event/list
  - For the audit log, type:
    
    show /SP/Logs/audit/list
  - For the session log, type:
    
    show /SP/Logs/session/list
  To scroll the list, press any key except the q key.
2. To filter the log output, use the show command, and specify a value for one or more of the filter properties: Class, Type, Severity
  
  Examples:
  - Use one filter property, for example, Class:
    
    show /System/Logs/list Class== value
    
    or
    
    show /SP /logs/ event|audit /list Class== value
  - Use two filter properties, for example, Class and Type:
    
    show /System/Logs/list Class==value Type== value
    
    or
    
    show /SP/logs/ event|audit /list Class== value Type== value
  - Use all filter properties (Class, Type, and Severity):
    
    show /System/Logs/list Class==value Type==value Severity==value
    
    or
    
    show /SP/logs/event|audit/list Class==value Type==value Severity==value
3. To clear all log entries shown, use the clear=true command.
  
  For example:
  
  set /System/Logs/clear=true
  
  or
  
  set /SP/logs/ event|audit clear=true
  
  where event|audit appears, type either event or audit.
  
  When prompted, type y to confirm the action or n to cancel the action.

Related Information