Author: NetworkAdminKB.com
Created: 2011-09-01
Modified: 2011-11-09
By default all messages on the Netapp Controllers are logged to the console and the /etc/messages file.
You would like to configure your Kiwi Syslog server to receive messages from your Netapp Controller, you would also like to receive emails relating to key events on the Netapp Controllers.
You can use the following procedure to configure the Kiwi Syslog Server to record the important messages in a log file and archive it, but also email you when key events happen on the Netapp Controllers.
Assumptions:
- You are familiar with Kiwi Syslog and already have it installed.
- You have configured the Netapp Controllers to forward messages to this syslog server
1) Open the Kiwi Syslog Service manager
2) Click File…Setup
a. Create the Netapp Log rule
i. Right click Rules and select Add Rule
ii. Right click and rename the rule to Netapp-Log
iii. Right click Filters and add a Hostname filter
1. Select Hostname field
2. Simple Filter type
3. Enter the fully qualified DNS name
4. Disable Substring Search (S box)
5. Rename the filter to new Hostname
iv. Right click Actions and add Display Action
1. Select Display for the Action
2. Select the Display ## to use
3. Rename the Action to the Display ## selected
v. Right click Actions and add Log to file Action
1. Select Log to file for the Action
2. Change the file name to be the Netapp’s name
3. Rename the Action to Netapp Log
b. Repeat the above for every Netapp Controller/Filer you have.
i. You can re-use the same display, but you should maintain separate log files.
c. Create Universal Netapp Email Rule used for all Netapp Controllers.
i. Right click Rules and select Add Rule
ii. Right click and rename the rule to Netapp-Email
iii. Right click Filters and add a Hostname filter
1. Select Hostname field
2. Simple Filter type
3. Enter a substring search common to all Netapp controller DNS names. For example netapp1.domain.com netapp2.domain.com simply use “netapp” as the substring search.
4. Leave Substring Search (S box) enabled (down).
5. Rename the filter to Hostname-substring
iv. Right click Filters and add a Message text filter
1. 
2. Select Message text field
3. Select Complex filter type
4. Rename filter to Exclude
5. Here is where you exclude things you do not want to be emailed on. This configuration is preferred, because you can still receive email on unknown items that may occur in the future.
6. Leave Substring Search (S box) enabled (down) on the Exclude field box.
7. Here are suggested items to type into the Exclude field, each item should be in quotes and separated by a space.
· "callhome."
· "cifs.oplock.break.timeout:warning"
· "cmds.sysconf.validDebug:debug"
· "diskown.changingOwner:info"
· "ems.engine.inputSuppress:info"
· "kern.log.rotate:notice"
· "lun.map:info"
· "lun.map.unmap:info"
· "monitor.globalStatus.ok:info"
· "monitor.volume.ok:debug"
· "monitor.volume.nearlyFull:debug"
· "nbt.WINS.registrationTimeout:info"
· "raid.aggr.log.CP.count:debug"
· "raid.rg.scrub.done:notice"
· "raid.rg.scrub.resume:notice"
· "raid.rg.scrub.start:notice"
· "raid.rg.scrub.suspended:notice"
· "raid.rg.scrub.summary.cksum:notice"
· "raid.rg.scrub.summary.media:notice"
· "raid.rg.scrub.summary.pi:notice"
· "scsi.cmd.retrySuccess:debug"
· "SMBRPCWorker"
· "wafl.snap.autoDelete.deleteStateSnap:info"
· "wafl.snap.autoDelete:info"
· "wafl.snap.delete:info"
· "wafl.vol.autoSize.done:info"
· "wafl.volume.snap.autoDelete:info"
· "wafl.spacemgmnt.policyChg:info"
· "wafl.vvol.renamed:info"
· "}.aux"
· "}.rws"
8. As you receive emails you can modify the exclude text to prevent those emails from being sent.
v. Right click Actions and add E-mail message Action
1. 
2. Select E-mail message from Action
3. Type in your email address as the Recipient
4. Type in the from email address as needed
5. Edit the E-mail message as needed.
6. Rename the Action to Email
d. Configure Kiwi Email settings to send email
e. Configure Kiwi DNS settings to resolve DNS names
3) Save settings
4) Review the Netapp Display to make sure items are being received
5) Review the Netapp log to make sure they are being recorded
6) Remove the Exclude text or entire rule to test receiving emails as needed.
7) Enable log file rotation or configure archiving rules/policies as needed.
This completes the setup of your Kiwi Syslog server. All you have to do now is wait and monitor your email. Add additional strings to the exclude list as things come up specific to your environment and your needs.
If you need to know how to configure the Netapp controller to send syslog message follow this article
How to configure a Netapp FAS to forward syslog messages Article ID: 454, Created On: 11/9/2011, Modified: 11/9/2011