System Event Log and the RLM

The RLM has a non-volatile memory buffer that stores up to 4,000 system events in a System Event Log (SEL). The SEL stores each audit log entry as an audit event. It is stored in onboard flash memory on the RLM. When the buffer is full, the oldest records are overwritten by the newest records.

You can view the audit log entries that are stored in the SEL, along with other stored events, by entering the RLM events command. You can also use the rlm log audit command to perform a quick search for audit logs from the SEL events log. However, the debug logs and message logs are stored separately on the RLM in its RAM and provide debug data for RLM firmware.

The SEL stores platform-specific events. This log is self-contained and does not support the Syslog Translator.

The primary purpose of this log is to help you diagnose system issues. The event list from the log is automatically sent by the RLM to specified recipients as an attachment to AutoSupport e-mails. The log can also be manually downloaded using the RLM events all command. In addition, you can use DataFabric Manager to view logs from the RLMs of systems managed through DataFabric Manager.

The records contain the following data:

Hardware events detected by the RLM—for example, system sensor status about power supplies, voltage, or other components
Errors (generated by the storage system or the RLM) detected by the RLM—for example, a communication error, a fan failure, a memory or CPU error, or a “boot image not found” message
Critical software events sent to the RLM by the storage system—for example, a system panic, a communication failure, an unexpected boot loader prompt, a boot failure, or a user-triggered “down system” as a result of issuing the system reset or system power cycle command.

Note: The SEL uses the RLM’s clock to time-stamp events. RLM begins synchronizing its clock with the system clock as soon as the storage system boots up. However, synchronizing takes a few seconds. If events occur during these few seconds, they are time-stamped January 1, 1970.

Recent records from the SEL are attached to the AutoSupport messages sent by the RLM.

The following example shows the result of entering the RLM events command:

RLM toaster> events search WD
Record 5: Tue Mar 29 07:39:40 2005 [Agent Event.warning]: FIFO 0x8FFF - Agent XYZ, L1_WD_TIMEOUT asserted.
Record 6: Tue Mar 29 07:39:42 2005 [Agent Event.critical]: FIFO 0x8FFE - Agent XYZ, L2_WD_TIMEOUT asserted

Parent topic: How to display information about the storage system and the RLM