Supportability Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

Supportability Events

Base Rule

General Information Log Message

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 1201, 1202, 1203, 1204, 1205, 1206, 1207, 1208, 1209, 1210, 1211, 1212, 1213, 1214, 1215, 1216, 1217, 1218, 1219, 1220, 1221, 1222, 1225, 1226, 1227, 1228, 1229, 1230, 1231

Severity

<severity>

Text/String

For 1223-1232: Information
For 1202-1205, 1208, 1215, 1229: Error
For 1207, 1210: Warning
For 1201, 1206: Critical
For 1209, 1211, 1212, 1216 : Emergency

Message

<subject>
<process>
<object>

Text/String

Event ID 1201:
A daemon has crashed and generated core dump

<subject>

Text/String

Event ID 1202:
Logs kernel crash

<subject>
<result>

Text/String

Event ID 1203:
Logs kernel failed to compress vmcore

<subject>
<result>

Text/String

Event ID 1204:
Logs kernel panic occurred and secondary kernel core failed to save uncompressed core

<subject>

Text/String

Event ID 1205:
Logs kernel panic occurred

<subject>
<reason>
<object>

Text/String

Event ID 1206:
Logs reboot information

<subject>

Text/String

Event ID 1207:
Event raised when available system memory is restored to normal level.

<subject>

Text/String

Event ID 1208:
Event raised when system memory usage goes beyond high threshold.

<subject>

Text/String

Event ID 1209:
Event raised when system memory usage crosses critical threshold.

<subject>

Text/String

Event ID 1210:
Event raised when memory reservation for reboot library fails.

<subject>

Text/String

Event ID 1211:
Event raised when system memory read is failing.

<subject>

Text/String

Event ID 1212:
Available memory is critically low, system will be rebooted.

<subject>

Text/String

Event ID 1213:
Event raised when the sampled value has reached the rising threshold.

<subject>

Text/String

Event ID 1214:
Event raised when the sampled value has reached the falling threshold.

<subject>
<process>
<reason>

Text/String

Event ID 1215:
A process is exiting due to an unrecoverable error

<subject>
<process>
<reason>

Text/String

Event ID 1216:
A critical process is exiting due to an unrecoverable error

<subject>

Text/String

Event ID 1217:
Coredump(s) are deleted by user

<subject>
<dname>
<object>

Text/String

Event ID 1218:
Event raised when a new syslog server is added for remote logging.

<subject>
<dname>
<object>

Text/String

Event ID 1219:
Event raised when a syslog server is removed from remote logging.

<subject>
<dname>
<object>

Text/String

Event ID 1220:
Event raised when an existing syslog server configuration is modified.

<subject>

Text/String

Event ID 1221:
Event raised when available RAM memory goes below the threshold and watchdog timeout is increased.

<subject>

Text/String

Event ID 1222:
Event raised when the available RAM memory is restored to normal range and the watchdog timeout is restored to default value.

<subject>
<object>
<objecttype>
<objectname>

Text/String

Event ID 1225:
Event raised when support-files collection is requested.

<subject>
<object>

Text/String

Event ID 1226:
Event raised when a request received to delete given support-files.

<subject>
<object>

Text/String

Event ID 1227:
Event raised when support-files is deleted.

<subject>
<object>
<reason>

Text/String

Event ID 1228:
Event raised when collection support-files failed.

<subject>
<object>
<reason>

Text/String

Event ID 1229:
Event raised when failed to delete a given support-files.

<subject>
<object>
<status>

Text/String

Event ID 1230:
Event raised when collection of support-files state changes.

<subject>

Text/String

Event ID 1231:
Event raised when remote syslog is restarted due to configuration change.