IBM Storage The online community where IBM Storage users meet, share, discuss, and learn. Join the Community
I'm trying to set up some basic monitoring of a DS8000 system using the API reference as a guide. I'd like to be able to query the system every few minutes and filter out active errors/warnings for our monitoring systems.
Can anyone here clarify for me if it is possible to filter events by active / inactive status via the API like you can do via the UI?
The limited information in the API doc doesn't provide a way to do this. The parameters returned in the query do not indicate whether the event is inactive either.
QueryGET /v1/events[?severity=info,warning,error&after=2014-04-20T13:00:00+0800&before=2014-04-20T13:00:59+0800]Response..."id" : "SE...""type" : "PoolCapacityChanged" ,"severity" : "error","time" : "2014-04-20T13:00:23-0700","resource_id" : "","formatted_parameter" : [ ]...
When I issue the query I end up with a bunch of warnings and errors and have no way of verifying if they are still relevant or have already been addressed.
Sorry this isn't a direct suggestion regarding the API you're investigating. However, in reading your post, it made me think of a potential solution being OMEGAMON for Storage on z/OS which provides both the current status and context for whether problems still exist. In other words, the monitoring system has this feature built in. Not sure if this would be helpfiul for you or not but figured I'd drop a note - https://www.ibm.com/docs/en/om-stor/5.4?topic=users-guide
Yeah...interesting...doesn't look like the HW is returning back a field for whether it's active/inactive. Wonder if the DSGUI is somehow storing that internally instead of at the server level. Can you open up an RFE for the request?
In the meantime, a more efficient way to handle DS8000 notifications might be through the use of a remote syslog server. You can set that up on DS8000 so that all the events get sent over to the syslog server which you can then use to create automation to process as the events come in...as opposed to querying for events. For example you can use QRadar to help with detecting an attack on the storage system if there have been too many failed login attempts etc.
Thank you for the suggestions but I'm not looking to parse and handle every event, that would entail a considerably more complex solution than simply asking the array what is currently wrong with it and forwarding that to our monitoring and ticketing systems. The Array maintains this information and is capable of presenting it, but for some reason this information doesn't seem to be available via the API interface. The API doesn't seem to get a lot of love from the developers and is very limited in it's features compared to other storage platforms, even IBMs own storwize.
I'll look for other methods access this information, thank you again for your responses.
I agree that the API needs more support for developers. However, the majority of customers looking to do something like you're doing actually do use the rsyslog to auto process events. An rsyslog server can easily parse out the event for you, you just need to look for certain event types which are doc'd by DS8000 and then tell the syslog server what the events are and what to do should they get the event. And most rsyslog servers provide hooks into ticketing systems now adays.
But please open the RFE so that we can look at returning whether an event is active or inactive as well.