Managing Oracle ILOM Log Entries

Oracle ILOM maintains four system management logs: system log, event log, and audit log. For further details about these logs, see the following topics:

• Log Descriptions

• Log Properties

• Log Time Stamps

• View and Clear Log Entries (Web)

• View and Clear Log Entries (CLI)

• Filter Log Entries (Web)

• Filter Log Entries (CLI)

Log Descriptions

Log	Description
System	The top-level system log presents a subset of relevant operational event log entries. Specifically, this log reports subsystem-level diagnostic events pertaining to system inventory actions and component health. These events can include power on and off, FRU insertion and removal, as well as health status events, such as service required, warning, or OK.
Event	The event log tracks informational, warning, or error messages about a system such as the addition or removal of a component or the failure of a component. The event properties recorded in the event log can include: the severity of the event, the event provider (class), and the date and time the event was logged. The event log is helpful for troubleshooting the system when problems occur. It is also helpful for monitoring the performance of the system.
Audit	The audit log tracks all interface-related user actions, such as user logins, user logouts, configuration changes, and password changes. The user interfaces monitored for user actions include the Oracle ILOM web interface, CLI, Fault Management Shell, Restricted Shell, Diagnostics Shell, and SNMP and IPMI client interfaces. The audit log is helpful for auditing user activity to ensure that no privilege violations have occurred.

Log Properties

Property	Description	Applicable to:
Event ID	Unique number used to identify the encountered event.	System Log Event Log Audit Log
Date and Time	Day and time the event occurred. If the Network Time Protocol (NTP) server is enabled to set the Oracle ILOM time, the Oracle ILOM clock uses Universal Coordinated Time (UTC). For more information about time stamps, see Log Time Stamps.	System Log Event Log Audit Log
Event Type or Type	Hardware-dependent event property. Event type examples: IPMI UI Upgrade Persistence Action or Service Required Warning OK	System Log Event Log Audit Log
Subsystem	Hardware-dependent property that identifies the subsystem where the event was encountered. Subsystem examples: System Power Cooling Memory Storage I/O module Processor Firmware	System Log
Component	Hardware-dependent property that identifies the component where the event was encountered. Component examples: Hostn /SYS (Host System) PSn (Power Supply n) Fann (Fan n) Diskn (Disk n) Oracle ILOM	System Log
Class	Hardware-dependent property that identifies the event class. Class examples: Audit/Log – For commands that result in a configuration change. Description includes user, command, command parameters, and success/failure. IPMI/Log – For any event that is placed in the IPMI System Event Log is also put in the management log. Chassis/State – For changes to the inventory and general system state. Chassis/Action – For shutdown events for a server, hot insert/removal of FRU components. Fault/Fault – Description gives the time fault was detected and the suspect component name. Fault/Repair – For Fault Management repairs. Description gives component name.	Event Log Audit Log
Severity	Severity level of the event. Severity examples: Debug Down Critical Major Minor	Event Log Audit Log

Log Time Stamps

Local system time stamps, by default, are captured in the Oracle ILOM log files by using the host server system clock UTC/GMT time zone. However, if a log file is viewed from a remote client that is located in a different time zone, Oracle ILOM automatically adjusts the time stamps in the log files to reflect the local time zone of the remote client and the host system. In this case, two time stamps appear in the log for each listed event entry. In addition to supporting local system time stamps, Oracle ILOM enables you to capture remote router time stamps using a Network Time Protocol (NTP) server. For information about the way to modify how Oracle ILOM captures time stamps for logged entries, refer to the Oracle ILOM Administrator's Guide for Configuration and Maintenance at Systems Management Documentation.

View and Clear Log Entries (Web)

Oracle ILOM log entries for a server are viewable from the Oracle ILOM web interface.

1. Verify that you have Admin (a) role privileges, which are required to clear log entries.
2. To view the log entries, perform one of the following:

   • To view the system log entries, click System Information → System Log.

   • To view the event or audit log entries, click ILOM Administration → Logs, and then click the Event or Audit tab.

   The selected Oracle ILOM log page appears.

3. To clear all log entries shown, click the Clear Log button in the log table, and then click OK in the message box that appears.

   Oracle ILOM removes all entries in log file.

View and Clear Log Entries (CLI)

1. Verify that you have Admin (a) role privileges, which are required to clear log entries.
2. To view a tabular list of log entries, do one of the following:

   • For the system log, type show /System/Log/list.

   • For the event log, type show /SP/Logs/event/list.

   • For the audit log, type show /SP/Logs/audit/list.

     To scroll through a list, press any key except the q key.

3. To clear log entries shown, type set target clear=true, and then type y at the prompt.

   For example:

   • set /System/Log clear=true

   • set /SP/logs/event/ clear=true

   • set /SP/logs/audit clear=true

Filter Log Entries (Web)

1. Select System Information → Logs.
2. Select either a standard filter or a custom filter from the Filter list.

   For further details about filtering log entries shown in the web interface, click the More Details link on the web page.

Filter Log Entries (CLI)

1. From the CLI, issue the show command followed by one or more supported log filter properties.

   For example:

   • To filter the system log entries by subsystem or Event Type, type one of the following:

     show /System/Log/list Subsystem== subsystem

     show /System/Log/list Type== type

   • To filter the event or audit log entries by Class, type show / SP/logs/|event|audit /list Class== class.

   • To filter the event or audit log entries by Class and Type, type show /SP/logs|event|audit /list Class== class Type== type.

   • To filter the event or audit log entries using all the filter properties, type show /SP/logs event|audit /list Class== class Type== type Severity== value.

   Where:

   • subsystem is the subsystem component name, for example: System, Cooling, or Processor.

   • type is the event name or the component name where the event occurred, for example: OK, Warning, Service Required, Fann, Processorn, DIMMn, UI, Product, Log, Update, or Action.

   • class is the class event name, for example: System, Fault, Chassis, Software, Audit, BIOS, or Sensor.

   • severity is the event severity, for example: Debug, Down, Critical, Major, or Minor.

   • event|audit indicates a choice between the event and audit log. Type event to filter the event log, or type audit to filter the audit log.

Log Properties

View and Clear Log Entries (Web)

View and Clear Log Entries (CLI)