Re: Reading and erasing iLO logs without losing events between operations (198 Views)
Reply
Occasional Visitor
fcolombo
Posts: 2
Registered: ‎10-01-2013
Message 1 of 4 (256 Views)

Reading and erasing iLO logs without losing events between operations

I need to record iLO logs (such as server resets, power failures or invalid logins) into Windows Events. I developed a program that captures ouput of the following:

 

  hponcfg.exe /f get_ilo_log.xml

 

Where get_ilo_log.xml is defined as:

 

<RIBCL version="2.21">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="READ" >
<GET_EVENT_LOG />
</RIB_INFO>
</LOGIN>
</RIBCL>

 

After this, the program calls hponcfg.exe again, in order to erase logs with the following script:

 

<RIBCL VERSION="2.0">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="write">
<CLEAR_EVENTLOG/>
</RIB_INFO>
</LOGIN>
</RIBCL>

 

The problem is that we lose all iLO events happening in the time between reading the logs and erasing them. This is particularly bad during a Denial of Service atack, where we cannot lose any iLO event.

 

So I need a way to safely erase iLO logs without losing anything. It would be nice if I could either query or erase only logs from a date range or other filter.

Please use plain text.
Trusted Contributor
Casper42
Posts: 260
Registered: ‎10-07-2010
Message 2 of 4 (214 Views)

Re: Reading and erasing iLO logs without losing events between operations

Not sure if this will work, but why not combine your scripts.

<RIBCL version="2.21">
<LOGIN USER_LOGIN="adminname" PASSWORD="password">
<RIB_INFO MODE="READ" >
<GET_EVENT_LOG />
<CLEAR_EVENTLOG/>
</RIB_INFO>
</LOGIN>
</RIBCL>

This way the Read and Erase are run as close together as possible.
Please use plain text.
Occasional Visitor
fcolombo
Posts: 2
Registered: ‎10-01-2013
Message 3 of 4 (204 Views)

Re: Reading and erasing iLO logs without losing events between operations

[ Edited ]

Thanks, but I guess it's not enough. This reduces window of lost events, but does not prevent them.

Please use plain text.
Honored Contributor
Jimmy Vance
Posts: 1,485
Registered: ‎11-27-2006
Message 4 of 4 (198 Views)

Re: Reading and erasing iLO logs without losing events between operations

You might try something like this

 

<RIBCL version="2.21">

<LOGIN USER_LOGIN="adminname" PASSWORD="password">

 

<RIB_INFO MODE="READ" >

   <GET_EVENT_LOG />

</RIB_INFO>

 

<RIB_INFO MODE="write">

  <CLEAR_EVENTLOG/>

</RIB_INFO>

 

</LOGIN>

</RIBCL>

Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation