Piszki Lab | EN

My case study in the clouds…

EMC VNX Content Pack for vRealize Log Insight – installation and configuration.

| 7 Comments

From VMware Solutions Exchange site you can download the EMC VNX Content Pack for vRealize Log Insight. This is a very good convenience to the users of both products. Unfortunately, along with this extension has not been published documentation describing the configuration on VNX side. Searching the Internet I not found the information in a consistent manner that shows how to configure the EMC VNX array to send logs to a central syslog (which is the Log Insight). For VNX File it’s not big problem, the controller is managed by the Linux system and simply redirect your logs. However, in the case of EMC Block, there is a rare case when the controllers are working under Windows control for which there is no access. In this case, we need to have a proxy server with installed  Unisphere Host Agent. In this post I will explain step by step configuration of all components, starting by installing the Unisphere Agent.

li-logo

The installation file of Unisphere Host Agent can be downloaded from the EMC Support for any operating system (Linux, AIX, Solaris, Windows). The agent logs to the storage, retrieves events and writes them to the log on which system is installed (in Unix is /var/log messages in Windows this is the Application log). During installation, the agent will be asked to enter the IP addresses of the two controllers (SP).

emc11

Check the agent.config file created during installation. Windows Installer creates entries starting with “User” and the correct value is “user”:

emc10

I decided to use the Windows agent, in this case, an additional step is required. We need to get (vRealize Log Insight -> Administration -> Agents) and install the agent who will send logs from Windows to our vRealize Log Insight. You do not need to configure anything, the agent will automatically send the Application log to vRealize Log Insight.

emc12

Remember, that such a scheme takes us one license (OSI) in the Log Insight. At this point, we can go to Unisphere and configure remote logging. Go to the “System -> Monitoring and Alerts -> Notification for Block”. We’ll start with the preparation of the corresponding template (which is what we will log):

emc1

Go to the “Centralized Monitors” and add “Portal”. Portal within the meaning of the EMC is a system that intermediary collecting logs from both SP. This may be VNX File (Cellerra) if we have it, or Unisphere Central. Due to the weight that can generate a login event, the preferred method is external system (Unisphere Central).

emc2

I chose the NAS because its low load in my environment.

emc3

In the next step, add the Event Monitor.

emc4

Event Monitor is nothing like our Unisphere Host Agent, we can provide the IP address or subnet scan given. We have connected more than one agent.

emc6

This is the correct configuration:

emc7

In the next step, click on the “System Monitor” and choose our Portal (a little weird) and connect to the pre-defined profile (Use Template):

emc8

At this stage, we are all set.

emc9

At this point, we can check if the logs are properly taken (as you can see in the picture below, everything works as intended):

emc13

Now we can go to vRealize Log Insight and install (from the marketplace or manually) EMC VNX Content Pack and watch what happens in our VNX:

emc15

Logs from the storage appear in vRealize Log Insight.

Rate this article:
[Total: 3    Average: 4.7/5]

Author: Piotr Pisz

Computer always, since I got a Commodore 64 at the end of primary school, through his beloved Amiga and Linux infinite number of consoles, until today, fully virtual day. Since 2001, Unix/Linux Systems Administrator, for seven years a faithful companion and protector of Solaris system, until his sad end. In the year 2011 came in the depths of virtualization, then smoothly ascended into the clouds and continues there today. Professionally working as Systems Architect in the Polish Security Printing Works.

7 Comments

  1. Hi , I followed the steps you have given. but i got stuck at “Configure Centralized Monitor”
    I am not able to add the windows machine on which my Unisphere host agent is there and gives an error ” storage system not found” .I am trying to configure”Notifications for Block”

    • Hi Akshay,

      Are you open TCP port 6389 in firewall on Unisphere host agent machine? Looks like communications problem between VNX–>Agent.

      Regards,
      Piotr

  2. Buenos días Piotr, esta configuración aplica para VNX5200 y servidor syslog Externo?
    Por favor. Gracias

    • Hello Patricia,

      Of course, simple install the Host Agent on your external syslog! Or by installing the Log Insight Agent (is free), and point the address of an external syslog. Log Insight is just an example, this solution works with any syslog! And with each VNX ;-)

      Regards,
      Piotr

      • Gracias Piotr, una ultima consulta, tienes por favor este mismo procedimiento para configurar servidor externo de Syslog desde Avamar y sw conectrix.tks

  3. Hello Piotr,

    Your work is very interesting to me, since my current goal is to get all my VNX logs in an ELK stack I have around.
    My (rather old) EMC setup is a multi-domain one having one Unisphere off-array server (hosted on a Windows VM / no HBA) in its own domain and several VNX arrays, each in their own domains. I’m not sure if this architecture/hardware is compliant with the setup you are describing here.

    I installed Navisphere host agent on the off-array Windows VM, add it first as a portal, then add it as a centralized event monitor in that portal, then get…. nothing. i.e the Windows VM does not register itself on the array (sounds normal, since it doesn’t have any HBA) and I don’t get any entry in the ‘monitored system’ tab.

    Anyway. I tried to add one of the VNX in the portal, like I previously did with my Windows VM and failed with a ‘Storage not found’ error. Port 6389 is open both way from/to the host agent and the VNX array.

    I’m a bit confused about the rôle of each component in this setup. Who is responsible for collecting the logs ? the portal ? the host agent ? Who is talking to the VNX ? Does the single/multi domain is important ? Is the host agent mandatory ? Does it have to be hosted on a SAN connected host ?

    Any help would be greatly appreciated,

    cheers,
    Jean-Fabrice

    • Hi Jean-Fabrice,

      I’m sorry that I answer with delay, it does not matter whether it is single or multi domain.
      Only the agent is responsible for collecting logs, it operates in a point-to-point (Agent to VNX) and not need an HBA to communication with VNX.
      Double check your configuration.

      Regards,
      Piotr

Leave a Reply

Required fields are marked *.


.

Enjoyed the post? Support Piszki Lab | EN, click on the AD! :-)

.