Category: SAN/NAS/Storage

Configuring remote event logging on EMC VNX storage systems involves setting up the system to forward its event logs to a remote syslog server. Here are the steps to configure remote event logging on an EMC VNX system:

Prerequisites

1. **Syslog Server**: Ensure you have a syslog server set up and accessible from the VNX storage system.

2. **Network Configuration**: Verify network connectivity between the VNX storage system and the syslog server.

3. **Administrative Access**: You need administrative access to the VNX Control Station.

Steps to Configure Remote Event Logging

1. **Access the VNX Control Station**:

   – Use an SSH client to connect to the Control Station of the VNX system. Log in with administrative credentials.

2. **Edit the Syslog Configuration File**:

   – Open the syslog configuration file for editing. The configuration file is usually located at `/etc/syslog.conf` or `/etc/rsyslog.conf`, depending on the system configuration.

  

   vi /etc/syslog.conf

  

   Or if using rsyslog:

  

   vi /etc/rsyslog.conf

  

3. **Add Remote Syslog Server Entry**:

   – Add a line to forward the logs to the remote syslog server. The syntax depends on the syslog service in use. Here are examples for both `syslog` and `rsyslog`:

   For `syslog`:

  

   *.* @<remote_syslog_server>:514

  

   For `rsyslog`:

  

   *.* @@<remote_syslog_server>:514

  

   Replace `<remote_syslog_server>` with the hostname or IP address of your syslog server.

4. **Restart the Syslog Service**:

   – After editing the configuration file, restart the syslog service to apply the changes.

   For `syslog`:

  

   service syslog restart

  

   For `rsyslog`:

  

   service rsyslog restart

  

5. **Verify Configuration**:

   – Check if the VNX system is successfully sending logs to the remote syslog server. You can verify this by observing incoming logs on the syslog server or by using network monitoring tools.

Additional Considerations

– **Log Levels and Facilities**: You can customize which log levels and facilities are forwarded to the remote syslog server by specifying them in the configuration file.

– **Firewall Settings**: Ensure that the network firewall allows traffic on the syslog port (default is 514) from the VNX system to the syslog server.

– **Redundancy**: Consider setting up multiple syslog servers for redundancy and load balancing if necessary.

Example Configuration

Here’s an example of a `syslog.conf` entry to forward all logs to a remote server with IP address `192.168.1.100`:

*.* @192.168.1.100:514

And for `rsyslog.conf`:

*.* @@192.168.1.100:514

After editing the configuration file, restart the appropriate service:

service syslog restart

or

service rsyslog restart

By following these steps, you can configure your EMC VNX storage system to forward event logs to a remote syslog server, allowing for centralized log management and monitoring.

How to change the Control Station IP Address and Subnet Mask

Log in to the Control Station as root.

Change the IP address and network mask by using this command syntax:

Note: /sbin/ifconfig -a revealed eth3 to be my cs0 interface.

 

# /sbin/ifconfig eth3 <ipaddr> netmask <netmask>

e.g. /sbin/ifconfig eth3 172.24.101.100 netmask 255.255.255.0

 

This changes the immediate configuration, but does not persist across restarts.

Edit the network scripts file, /etc/sysconfig/network-scripts/ifcfg-eth3, by using a text editor (that means vi)

DEVICE=eth3

IPADDR=172.24.101.100
NETMASK=255.255.255.0
NETWORK=172.24.101.0
BROADCAST=172.24.101.255
ONBOOT=yes

Edit the local hosts file, /etc/hosts

Look for lines with the old IP address.

Replace the old IP address with your new IP address.

Save the file and exit.

If you are changing the Control Station IP address, but remaining on the same network, then the SP IP addresses for an integrated model need not be modified. However, if you are changing to a different network, the SP IP addresses must be modified to be on the same physical network as the Control Station for the Integrated model. Use the clariion_mgmt -modify -network command to update the IP addresses on the SP, as it will also update the files and Celerra database with the modified IP addresses.

How to change the Control Station default gateway

Log in to the Control Station as root using SSH. Add a default route by typing:

 

# /sbin/route add default gw 172.24.101.254

 

This changes the immediate configuration, but does not persist across restarts.

Edit the network configuration file, /etc/sysconfig/network-scripts/ifcfg-eth3, by using a text editor.

Add the new gateway IP address for the entries similar to:

DEVICE=eth3
IPADDR=172.24.101.25
NETMASK=255.255.255.0
NETWORK=172.24.101.0
BROADCAST=172.24.101.255
ONBOOT=yes
GATEWAY=172.24.101.254

Save the file and exit.

To enable NFSv4 on your up-to-date (post VNX OE for File v7.1) VNX Unified storage system and configure a datamover to mount a filesystem to allow for NFSv4 access with a MIXED access policy, the following steps serve as a concise guide.  NFSv4 cannot be done via Unisphere.

Log onto control station as nasadmin user via SSH using PuTTY.

START NFSv4 Server on VNX
server_nfs server_2 -v4 -service -start

SET DOMAIN NAME to nfsv4.domain (change as required)
server_param server_2 -facility nfsv4 -modify domain -value nfsv4.domain

LIST NFSv4 DOMAIN INFO
server_param server_2 -facility nfsv4 -info domain

LIST NFSv4 INFO
server_param server_2 -facility nfsv4 -list

MOUNT NFS_TEST_2 on server_2 for NFSv4 access
server_mount server_2 -option accesspolicy=MIXED NFS_TEST_2 /NFS_TEST_2

TRANSLATE existing, mounted NFS filesystem from NATIVE access policy to MIXED access policy
nas_fs -translate NFS_TEST_2 -access_policy start -to MIXED -from NATIVE

DISPLAY NFSv4 CLIENT CONNECTIONS
server_nfs server_2 -v4 -client -list

NFSv4 requires UNICODE enabled on DM. Check…
server_cifs server_2 | grep I18N
I18N mode = UNICODE

DISPLAY NFSv4 STATUS
server_nfs server_2 -v4

It’s highly likely that if you require NFS v4, then you’ll also need to authenticate access, using a UNIX based Kerberos DC.  The following notes cover the configuration steps involved.  Please note that this section below is still a work in progress and you should refer to the official EMC documentation for a complete set of instructions with examples.

SECURE NFS (using UNIX Kerberos Authentication)

CONFIGURE THE KERBEROS REALM
server_kerberos server_2 -add realm=<realm-name>,kdc=<fqdn_kdc_name>,kadmin=<kadmin_server>,domain=<domain_name>,defaultrealm
Note realm,kdc, kadmin,domain should all be entered as fqdn’s

VERIFY THE RESULTS
server_kerberos server_2 -list

SET THE SECURE NFS SERVICE INSTANCE
server_nfs <datamovername> -secnfs
Note server_2 is set already during VNX installation.

CHANGE THE SECURE NFS SERVICE INSTANCE
server_nfs <newdatamovername> -secnfs -principal -delete nfs@server_2
Note This is only required if you change the default datamover hostname from server_2 to e.g. Ingbe245
server_nfs <newdatamovername> -secnfs -principal -create nfs@<server>
Note <server> is type of the realm, and needs to be entered twice, once with short name, e.g. Ingbe245 and once more with fqdn

STOP AND START THE NFS SERVICE
server_nfs server_2 -secnfs -service -stop
server_nfs Ingbe245 -secnfs -service -start

DETERMINE IF KEYTAB FILE EXISTS ON DATAMOVER
Copy /.etc/krb.keytab file (if it exists) to the Kerberos KDC.

CREATE NFS KERBEROS SERVICE PRINCIPALS
Note. The kadmin steps are performed on the Kerberos KDC, not the VNX
kadmin: addprinc=randkey nfs/Ingbe245
kadmin: addprinc=randkey nfs/Ingbe245.fqdn.local

VERIFY THAT THE PRINCPALS HAVE BEEN ADDED
kadmin: listprincs

GENERATE SECURITY KEYS
kadmin: ktadd -k <keytab_file_path> nfs/ <name>
<keytab_file_path> = location of key file
<name>=name of previously created service principal e.g. nfs/Ingbe245

COPY KEYTAB FILE
Copy the krb5.keytab file from Kerberos KDC to the Data Mover by using FTP and the server_file command.
Note. EMC Common Anti-Virus Agent (CAVA) is also configured using the server_file command to place and displace the viruschecker.conf file.  There are notes on that here but to save you the trouble, the command for your convenience is…

server_file server_2 -get krb5.keytab krb5.keytab

server_file server_2 -put krb5.keytab krb5.keytab
VIEW THE KEYTAB FILE
server_kerberos Inbe245 -keytab

MAP USER PRINCPAL NAMES TO UIDs
VERIFY THE TYPE OF MAPPING SERVICE USED BY SECURE NFS
server_nfs <datamovername> -secnfs -mapper -info

USE AUTOMATIC MAPPING
server_nfs <datamover_name> -secnfs -mapper -set -source auto

MONITOR INBOUND CONNECTIONS FROM NFSV4 CLIENTS
server_nfs server_2 -v4 -client -list

Most things VNX can be exported using Unisphere’s little export icon in the top right hand corner of most if not all dialogs.  Disk information would be found under System, Hardware, Disks.  You’ll see there is a part number column, but no serial number column in Unisphere for the disks.

To obtain the serial number of the HDD’s in your array, download and install naviseccli on your laptop/storage management server and use the following command…

naviseccli –h <sp-ip-address> -User sysadmin –Password ********* -Scope 0 getdisk –serial

If a security file containing the credentials is already present on the storage management server, then you won’t need to specify the username and password in plain text as shown above.