Re: Reading and erasing iLO logs without losing events between operations (268 Views)
Reply
Occasional Visitor
fcolombo
Posts: 2
Registered: ‎10-01-2013
Message 1 of 4 (326 Views)

Reading and erasing iLO logs without losing events between operations

I need to record iLO logs (such as server resets, power failures or invalid logins) into Windows Events. I developed a program that captures ouput of the following:

 

  hponcfg.exe /f get_ilo_log.xml

 

Where get_ilo_log.xml is defined as:

 

<RIBCL version="2.21">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="READ" >
<GET_EVENT_LOG />
</RIB_INFO>
</LOGIN>
</RIBCL>

 

After this, the program calls hponcfg.exe again, in order to erase logs with the following script:

 

<RIBCL VERSION="2.0">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="write">
<CLEAR_EVENTLOG/>
</RIB_INFO>
</LOGIN>
</RIBCL>

 

The problem is that we lose all iLO events happening in the time between reading the logs and erasing them. This is particularly bad during a Denial of Service atack, where we cannot lose any iLO event.

 

So I need a way to safely erase iLO logs without losing anything. It would be nice if I could either query or erase only logs from a date range or other filter.

Trusted Contributor
Casper42
Posts: 279
Registered: ‎10-07-2010
Message 2 of 4 (284 Views)

Re: Reading and erasing iLO logs without losing events between operations

Not sure if this will work, but why not combine your scripts.

<RIBCL version="2.21">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="READ" >
<GET_EVENT_LOG />
<CLEAR_EVENTLOG/>
</RIB_INFO>
</LOGIN>
</RIBCL>

This way the Read and Erase are run as close together as possible.
Occasional Visitor
fcolombo
Posts: 2
Registered: ‎10-01-2013
Message 3 of 4 (274 Views)

Re: Reading and erasing iLO logs without losing events between operations

[ Edited ]

Thanks, but I guess it's not enough. This reduces window of lost events, but does not prevent them.

Honored Contributor
Jimmy Vance
Posts: 1,572
Registered: ‎11-27-2006
Message 4 of 4 (268 Views)

Re: Reading and erasing iLO logs without losing events between operations

You might try something like this

 

<RIBCL version="2.21">

<LOGIN USER_LOGIN="adminname" PASSWORD="password">

 

<RIB_INFO MODE="READ" >

   <GET_EVENT_LOG />

</RIB_INFO>

 

<RIB_INFO MODE="write">

  <CLEAR_EVENTLOG/>

</RIB_INFO>

 

</LOGIN>

</RIBCL>

The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.