Dell SupportAssist Logs

You may be aware already but SupportAssist stores log messages here that correspond to the following values or higher (FATAL, ERROR,
WARN, INFO and DEBUG)

We use these logs to troubleshoot any issues you may have with SupportAssist, without them troublshooting would be difficult.  (for example, a case wasn’t created after an alert, Diagnostics didn’t run)

The logs will be purged from storage after 45 days. 

If keeping logs of this size for 45 days is still a concern, I can address this issue to see what alternatives we can provide.   Possible only showing FATAL/ERROR may reduce the size.

I’ll raise this issue up in a meeting tomorrow and provide additional feedback

You could upload one of the logs or provide a sample of a few hundred lines in the log or better yet post the clientID under help/about so we can analyze the information?

Thanks

Joe B

Thanks,

The clientID works, I’m able to retrieve and view the logs

Joe,

The log file at the moment is 837MB.  I won't be able to upload it.

The Client ID is: Client ID 213210

Here is a small subet of the log (from the start).  Please let me know if you need more.

2013-07-31 00:00:00,029: T0xPHOMEScheduler_Worker-4 Dell.Services.Ph.Ome.PhomePluginWindowsService.Jobs.CleanLogsJob INFO  Message=[Deleting logs older than 45 days from C:\Program Files (x86)\Dell\Dell Integrated Support\logs\]
2013-07-31 00:00:00,154: T0xPHOMEScheduler_Worker-4 Dell.Services.Ph.Ome.PhomePluginWindowsService.Jobs.CleanLogsJob INFO  Message=[0 Logs older than 45 days from C:\Program Files (x86)\Dell\Dell Integrated Support\logs\ were deleted]
2013-07-31 00:00:00,186: T0xPHOMEScheduler_Worker-19 CollectAssetInventoryJob INFO  Message=[Start collecting asset inventory from OME...]
2013-07-31 00:00:04,264: T0xPHOMEScheduler_Worker-19 CollectAssetInventoryJob INFO  Message=[Done collecting asset inventory from OME...]
2013-07-31 00:00:04,264: T0xPHOMEScheduler_Worker-19 CollectAssetInventoryJob INFO  Message=[Start compressing asset inventory data...]
2013-07-31 00:00:05,592: T0xPHOMEScheduler_Worker-19 CollectAssetInventoryJob INFO  Message=[Done compressing asset inventory data...]
2013-07-31 00:01:44,936: T0xPHOMEScheduler_Worker-12 OMEQueryJob INFO  Message=[Querying OME for alerts...]
2013-07-31 00:01:44,936: T0xPHOMEScheduler_Worker-12 OMEQueryJob DEBUG Message=[OME dll loaded.]
2013-07-31 00:01:44,936: T0xPHOMEScheduler_Worker-12 OMEQueryJob DEBUG Message=[Getting alerts...]
2013-07-31 00:01:44,936: T0xPHOMEScheduler_Worker-12 OMEQueryJob DEBUG Message=[Using LastAlertID: -2147342936]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 OMEQueryJob INFO  Message=[Retrieved 19651 raw alerts from OME.]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340223
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=753
EventID=2329]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340223 passed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2329  TrapID=753]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340222
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=751
EventID=2330]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340222 failed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2330  TrapID=751]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340221
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=753
EventID=2329]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340221 passed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2329  TrapID=753]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340220
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=751
EventID=2243]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340220 failed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2243  TrapID=751]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340219
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=751
EventID=2330]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340219 failed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2330  TrapID=751]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340218
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=753
EventID=2329]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340218 passed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2329  TrapID=753]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340217
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=751
EventID=2330]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340217 failed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2330  TrapID=751]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340216
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=753
EventID=2329]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340216 passed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2329  TrapID=753]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Filtering AlertID=-2147340215
EnterpriseOID=.1.3.6.1.4.1.674.10893.1.20.200
TrapID=751
EventID=2330]
2013-07-31 00:02:15,655: T0xPHOMEScheduler_Worker-12 AlertFilter DEBUG Message=[Alert -2147340215 failed policy check. Source=.1.3.6.1.4.1.674.10893.1.20.200  EventID=2330  TrapID=751]

Joe,

Do you have any idea why we are getting 2GB log files in a day?

Thanks,

Graeme

The following issue with the log size reaching to a gig is because thousands of alerts are being sent to OME/DSA.

Our Dev team is looking into the type of alert this is for and a possible recommendation.  I am hoping you could take a look at the following device as well. 

OME should have alerts displayed as well.

Two questions for you? 
Is DSA still enabled?  I stopped seeing log-files since 7/27/13 and that one was half a gig, up til that point all other logs prior to that date range from 3 to 7 MB.  I’m assuming the logs are too large to upload at this point.

I looked at the 7/27 log and one of your devices is sending thousands of traps/alerts.  Is this something you can investigate as well? 

Below is the following device.  Once we can determine why these alerts are happenening and put a stop to it the log files should return back to normal levels.  I believe a case was opened on 6/3/13 but haven’t see any alerts on that case since 7/27. 

519,329 occurences of EventID=2330  TrapID=751 (failed policy) and 519,320 occurences of  EventID=2329 TrapID=753  passed policy (SAS
port report)

Service Tag: JTBKBK1

                IP:192.168.145.43

                Model:PowerEdge M600

                DeviceName:cgquoteweb710.mgmt.local

                DeviceType:Server

                EventSource:.1.3.6.1.4.1.674.10893.1.20.200

                Diagnostics: False

                EventId: 2329

                TrapId: 753

                Message: Alert message ID: 2329,
Controller warning. SAS port report: SAS wide port 1 lost link on PHY 1.,
system, Controller 0 (SAS 6/iR Integrated) [Event Code:2329]

                OS: Microsoft Windows
Server 2003 R2, Standard Edition

                Severity:
8

                Timestamp:
2013-07-27T23:58:34GMT-04:00]

Hi

I ran the Dell Support Assist and it said there were errors.  Where do I find the errors log to see what the errors are please?

Thanks

Ayshe

Ditto.  The application does not tell me what the error is.  So where are the log files for me to find out what is wrong?  Thanks..