I would like to find a way to forward syslogs from multiple VNX systems to an external syslog server. What is the best way to do this?
1. configure each VNX individually (how do I do this)?
2. Can this be done in Unisphere if my systems are manged by Unisphere?
I accomplished this using a two step process to get the SP Event logs into our syslog system (Splunk).
First I had to run a naviseccli command to pull the logs off of each SP to a local file (naviseccli -h arrayIP getlog). This was scripted in Powershell for each SP separately and I also had the array name pre-pended to each line in the log for easy identification (we have over 40 arrays). The scripts are run as scheduled tasks and spaced apart from each other so that both SPs are not being queried at the same time.
Once the download and pre-pend are done, the files are grabbed by the Splunk Universal Forwarder agent that runs on the box and uploaded into Splunk.
It's not pretty but is fairly straightforward and works consistently. The only time things get off is when an SP becomes unreachable on its management IP. The script doesn't yet have the timeout logic added to bypass it and complete.
Was your question answered correctly? If so, please remember to mark your question Answered when you get the correct answer and award points to the person providing the answer. This helps others searching for a similar issue.