PowerFlex 4.X: Configuring syslogs and audit logs

    Configuring syslogs and audit logs

The audit log is supported for components like iDRAC, storage virtual machines, PowerFlex system, SDNAS, and CloudLink. Audit log configuration must be created at the source except in PowerFlex deployments and SDNAS deployments.

The logs can be transmitted through either of the following modes to the remote server:

• Directly
• Using PowerFlex Manager

For the audit log transmitted using PowerFlex Manager, Facility 13/Audit is used. The log retention for all components is available locally for 15 days.

Components and the source configurations

Consider the following while configuring the syslogs and audit logs:

• TLS is supported if the remote syslog server is configured directly.
• TLS is not supported if PowerFlex Manager is used to configure the remote syslog server.

Ensure the PowerFlex Manager user interface access and credentials are available to configure the remote syslog server.

To configure an external source and a destination, seePowerFlex 4.x Events and alerts Configure an external source and Configure a destination

Configure syslogs using VMware ESXi

Use this procedure to configure syslogs using VMware ESXi. All system logs are forwarded to a centralized location.

Steps

1. Log in to the VMware vSphere client.
2. Go to Manage > System > Advanced Settings.
3. To export logs to a central logging server, search for Syslog.global.LogHost.
4. Enter the protocol (UDP), IP address or FQDN, and the port number.

For example, udp://192.168.1.1:514 (or) tcp://192.168.1.1:514.

5. Click Save.
6. To ensure syslog is started and ports are added, go to Networking > Firewall rules and search for Syslog.

Configure and forward the syslogs using VMware vCenter

Use this procedure to configure and forward the syslogs using VMware vCenter.

Steps

1. Log in to the vCenter server management interface as root: <https://vcenterIP:5480>.
2. In the vCenter server management interface, select Syslog.
3. From the Forwarding Configuration pane, click Configure if you have not configured any remote syslog hosts. Click Edit if you already have configured hosts.
4. In the Create Forwarding Configuration pane, enter the server IP address of the destination host. The maximum number of supported destination hosts is three.
5. From the Protocol drop-down menu, select the protocol to use.
6. In the Port text box, enter the port number to use for communication with the destination host.
7. In the Create Forwarding Configuration pane, click Add to enter another remote syslog server and click Save.
8. Verify that the remote syslog server is receiving messages.
9. In the Forwarding Configuration section, click Send Test Message.
10. Verify on the remote syslog server that the test message was received.

The new configuration settings are displayed in the Forwarding Configuration section.

Configure syslog and audit logs in CloudLink

CloudLink supports four multiple syslog configurations from CloudLink 8.1. The audit log and system log are retrieved locally and available for 15 days.

Steps

1. Log in to CloudLink Center.
2. Click Server > Syslog > Add Syslog Server. The Add window appears.
   1. Provide the syslog IP address, port number, and select the facility and protocol. Click Add.

1. 2. If the service status of the syslog server is not active, click Resume. In the Confirm Syslog Mode Change window, click Resume.

The service status is Active.

3. To retrieve the logs locally:
   1. To enable SSH from CloudLink, click Server > Network > Change SSH.
   2. Select the Enabled option and click Change.
   3. SSH to the CloudLink IP address. The logs are in the /var/log/CLC_audit.log file.

For Full Guide See Dell PowerFlex Appliance with PowerFlex 4.x Administration Guide