Understanding events

When a significant change in status is detected, an event is logged in the event log.

Error data

Events are classified as either alerts or messages:
  • An alert is logged when the event requires some action. Some alerts have an associated error code that defines the service action that is required. The service actions are automated through the fix procedures. If the alert does not have an error code, the alert represents an unexpected change in state. This situation must be investigated to see whether it is expected or represents a failure. Investigate an alert and resolve it as soon as it is reported.
  • A message is logged when a change that is expected is reported, including an IBM® FlashCopy® operation completes.

Understanding event codes

The system generates informational event codes when significant changes to the state of the system are detected.

Informational event codes provide information on the status of an operation. Information events are recorded in the error event log, and depending on the configuration, you can be notified through email, SNMP, and the syslog.

Understanding the error codes

Error codes are generated by the event-log analysis and system configuration code.

Error codes help you to identify the cause of a problem, a failing component, and the service actions that might be needed to solve the problem.
Note: If more than one error occurs during an operation, the highest priority error code is displayed on the front panel. The lower the number for the error code, the higher the priority. For example, error code 1020 has a higher priority than error code 1370.

Viewing the event log

You can view the event log by using the management GUI or the command-line interface (CLI).

You can view the event log by using the Monitoring > Events options in the management GUI. The event log contains many entries. However, you can, select only the type of information that you need.

You can also view the event log by using the command-line interface (lseventlog). See the Command-line interface topic for the command details.

Managing the event log

The event log has a limited size. After it is full, newer entries replace entries that are no longer required.

To avoid having a repeated event that fills the event log, some records in the event log refer to multiple occurrences of the same event. When event log entries are coalesced in this way, the time stamp of the first occurrence and the last occurrence of the problem is saved in the log entry. A count of the number of times that the error condition has occurred is also saved in the log entry. Other data refers to the last occurrence of the event.

Describing the fields in the event log

The event log includes fields with information that you can use to diagnose problems.

Table 1 describes some of the fields that are available to assist you in diagnosing problems.
Table 1. Description of data fields for the event log
Data field Description
Event ID This number precisely identifies why the event was logged.
Description A short description of the event.
Status Indicates whether the event requires some attention.

Alert: if a red icon with a cross is shown, follow the fix procedure or service action to resolve the event and turn the status green.

Monitoring: the event is not yet of concern.

Expired: the event no longer represents a concern.

Message: provide useful information about system activity.
Error code Indicates that the event represents an error in the system that can be fixed by following the fix procedure or service action that is identified by the error code. Not all events have an error code. Different events have the same error code if the same service action is required for each.
Sequence number Identifies the event within the system.
Event count The number of events that are coalesced into this event log record.
Object type The object type to which the event relates.
Object ID Uniquely identifies the object within the system to which the event relates.
Object name The name of the object in the system to which the event relates.
Copy ID If the object is a volume and the event refers to a specific copy of the volume, this field is the number of the copy to which the event relates.
Reporting node ID Typically identifies the node responsible for the object to which the event relates. For events that relate to nodes, it identifies the node that logged the event, which can be different from the node that is identified by the object ID.
Reporting node name Typically identifies the node that contains the object to which the event relates. For events that relate to nodes, it identifies the node that logged the event, which can be different from the node that is identified by the object name.
Fixed Where an alert is shown for an error or warning condition, it indicates that the user marked the event as fixed, completed the fix procedure, or that the condition was resolved automatically. For a message event, this field can be used to acknowledge the message.
First time stamp The time when this error event was reported. If events of a similar type are being coalesced together, so that one event log record represents more than one event, this field is the time the first error event was logged.
Last time stamp The time when the last instance of this error event was recorded into this event log record.
Root sequence number If set, it is the sequence number of an event that represents an error that probably caused this event to be reported. Resolve the root event first.
Sense data Extra data that gives the details of the condition that caused the event to be logged.