Remote syslog - Account Creation, Modification and Deletion

Question

We recently configure remote syslog feature. We were doing some testing with accounts. Testing was carried out on this area which included account creation, modification and deletion for each IDRAC account. When I checked this in remote server, I did not see any events being generated for each action. Password changes carried out by tester were also not logged in remote server.

When I alter the idrac accounts, despite seeing these changes recorded under the Lifecycle Log, we don’t get anything sent to remote syslog. Under alerts we have all check boxes ticked under ‘Remote System Log’ under all 19 pages. Can you please confirm if this is by design or if we may have missed something?

Thank you

Dell-DylanJ · Accepted Answer

Use this page to configure the remote server settings to remotely write the RAC log and System Event Log (SEL) entries to an external server.

This is the help descriptor from that page, indicating that the RAC and SEL are the only components that would be sent to the syslog server. As you mentioned, the Lifecycle log catches these, but does not appear to be included in the syslog's export.

The Lifecycle controller log can be exported using the following:

racadm lclog export -f  -u 
   -p 
    -l

If you want regular updates, you might put that into a .bat file and then schedule it to run every so often with the task scheduler, or set up a cron job, if it's a Linux environment.

Dell-DylanJ · Answer

What server is this and what iDRAC firmware revision is installed? I'd be happy to give it a look, but the community would need to know what you're working with to assist.

nintrix · Answer

It is R330 and firmware is 2.61.60.60

DELL-Sirisha U · Answer

Hi,

Can you elaborate configure remote syslog feature.

When I alter the idrac accounts, despite seeing these changes recorded under the Lifecycle Log, we don’t get anything sent to remote syslog

when LC log records the alert, remote syslog is not able to capture even though alert options "Remote System Log" is Enabled.

default port is 514.

we have CLI/GUI options to configure RemoteSysLog

1. Using below racadm cmd

racadm set idrac.syslog. Server1

2. Attaching screen shot through GUI,

this configuration will make your alert actions to be logged in.

#IWork4Dell

Systems Management General

Remote syslog - Account Creation, Modification and Deletion

Was this post helpful?