All Apps and Add-ons

NetApp syslog truncated


I'm working with the Splunk TA ONTAP 2.1.7 and the NetApp A400 AFF.  The syslog-ng farm we have is receiving the syslog events being sent from the NetApp.  Two problems.  First is the messages don't look like what is in the sample files.

Mar 3 19:44:28 NetApp: NetApp: hex_digits_1.hex_digits_2 hex_digits_3 Wed Mar 03 2021 11:44:27 -08:00 [kern_audit:info:9521] hex_digits4 :: NetApp:http :: :: NetApp:CS\script :: GET /spi/NetApp/etc/log/stats/ccma/kernel/opm/078029_000300_1614800101000_0239077.ccma.gz HTTP/1.1 :: Success: 200 OK
7-mode samples
Dec 9 09:48:53 Dec 9 09:44:45 [cluster07:kern.syslogd.restarted:info]: syslogd: Restarted. ","",ontap,"udp:514","ontap:syslog","2016-12-09 09:48:53"
Dec 9 09:53:06 Dec 9 09:48:58 [cluster07:iscsi.notice:notice]: ISCSI: New session from initiator at IP addr
","",ontap,"udp:514","ontap:syslog","2016-12-09 09:53:06"
C-mode samples
Dec 9 11:21:35 Dec 9 11:22:01 [crest-cluster01-01:raid.rg.media_scrub.done:notice]: /aggr1/plex0/rg0: media scrub completed in 23:57.00 ","",ontap,"udp:514","ontap:syslog","2016-12-09 11:21:35"
Dec 9 11:23:39 Dec 9 11:21:04 [crest-cluster01-01:raid.rg.media_scrub.start:notice]: /aggr1/plex0/rg0: start media scrub ","",ontap,"udp:514","ontap:syslog","2016-12-09 11:23:39"
The 7 and C modes don't look anything like the syslog events that are in the syslog-ng.  The second issue is the messages are being truncated.
Mar 3 20:11:04 NetApp NetApp: NetApp: hex_digits_1.hex_digits_2 hex_digits_3 Wed Mar 03 2021 12:11:04 -08:00 [kern_audit:info:1817] hex_digits_4 :: NetApp:ontapi :: :: NetApp:DC\script :: <netapp version='1.0' xmlns='' nmsdk_version='9.5' nmsdk_platform='Windows Server 2016' nmsdk_language='Java'><diagnosis-alert-get-iter><query><diagnosis-alert-info><monitor>system-connect|node-connect</monitor><subsystem>FHM-Switch|metrocluster_node|metrocluster|fhm-bridge|sas_connect</subsystem><alert-id>InterclusterBrokenConnectionAlert|InterconnectAdapterOfflineAlert|RaidDegradedMirrorAggrAlert|RaidLeftBehindAggrAlert|RaidLeftBehindSpareAlert|StorageFCAdapterFault_Alert|ClusterSeveredAllLinksAlert|NoISLPresentAlert|FabricSwitchFanFail_Alert|FabricSwitchPowerFail_Alert|FabricSwitchTempCritical_Alert|FabricSwitchUnreachable_Alert|StorageBridgePortDown_Alert|StorageBridgeTempAboveCritical_Alert|StorageBridgeTempBelowCritical... :: Pending:
The above contains incomplete XML.  We have proved to ourselves that the listening port can take longer messages so the thought is the message is truncated at the sender.
If anyone has any ideas about why the messages don't look similar, I don't control the NetApp only Splunk, or why the messages get truncated, please let me know.
Splunk : 7.3.6
OS : Red Hat Enterprise Linux release 8.3 (Ootpa)
Labels (1)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>