FAQ: Overview of Event Management System for ONTAP 9

What is an EMS event message?

• EMS events are a record of occurences in ONTAP 9, and are by default logged in the Event Management System Log. EMS event messages have several components, which can be reviewed in the ONTAP event catalogue.

Example:  How to look up details on an EMS event message:

• The unique characteristic of any given event is the message name. In this example, the message name is monitor.volume.nearlyFull. Additionally, the severity is 'ALERT' and the SNMP Trap Type associated with the event is 'Built-in'.
• The Severity of any given event message is an indication of the expected impact of the event. Here is a list of the severities and an explanation of their meanings:

• The SNMP Trap Type is discussed in the ONTAP 9 Documentation Center
• Historically, prior to ONTAP 9, EMS Event Messages were individually configured to destinations on a per-message basis:

• Eventually, the catalog of EMS Event Messages grew and became difficult to manage on a per-message basis, and so a newer filter-based system of routing event messages was implemented in ONTAP 9. 
• The new system allows for rules-based event filters to collect events for delivery to event destinations by using event notifications to correlate event filters to event destinations. 
• Upon installation or upgrade to ONTAP 9, a basic configuration of event filters, event destinations, and event notifications is implemented by default. The default configuration can be disabled by removing event notifications, but the built-in event filters and event destinations cannot be modified or deleted (but they can be copied into new user customizable filters and destinations for further customization).

        -

• The built-in destination 'snmp-traphost' is linked to the default traphost configured for a storage system by running the command ' system snmp traphost add' or when configured through OnCommand System Manager at a URL similar to the following example:

https:// /sysmgr/SysMgr.html#snmp
 

How do ONTAP 9 EMS Event Filters work?

• Any time an EMS Event Message is generated, it will be compared against all configured EMS Event Filters. 
• An EMS Event Filter is a list of rules that include or exclude any given EMS Event Message. Each message is compared to the rules in an EMS Event Filter in sequential order, seeking to match the rule, and upon any match, further rule processing ceases. 
• The last rule in every EMS Event Filter will match every event message and exclude them. Therefore, if an EMS Event Message does not match an earlier rule, it will be excluded from the filter.  So, a newly created EMS Event Filter with only the default rule will not match ANY EMS Event Messages.
• You can create a custom EMS Event Filter similar to the following example:

• Notice, this newly created Event Filter automatically includes the default rule in position 1 that excludes Event Messages that match any criteria (Message Name, SNMP Trap Type, and Severity). This ensures the filter will not collect any EMS Event Messages that are not desired. 
• For the example EMS Event Message, monitor.volume.nearlyFull, create a rule that will collect it in the new filter.

• This rule will collect any events that match the message name monitor.volume.nearlyFull, however, assuming that it is required to collect all of the EMS Event Messages that match the query "monitor.volume.*", it is possible to

Now, our rule will collect all of these EMS Event Messages:

• However in testing, it was decided that it is not desirable to collect monitor.volume.ok. Therefore, insert a rule to be processed earlier in the event filter to exclude specifically that event message. This is how it is done:

• These examples focus on the EMS Event Message Name, however, it is possible to also filter on SNMP Trape Type or Severity as well. Therefore, for example, if you wanted to also have the filter collect all events of Severity level ALERT, you could add a rule using that criteria. 

What does Error: command failed: This rule does not match any event. Enter a valid rule. mean?

Example:

• This means the severity type is incorrect for the Ems message.
• To verify:

• The severity should be ERROR, the correct command would be

ClusterA::> event filter rule add -filter-name Inodes_Events -type include -message-name wafl.vol.runningOutOfInodes -severity ERROR

• For more information on the commands to manage EMS Event Filters, follow this link: ONTAP 9 Documentation Center.

How do ONTAP 9 EMS Event Notification Destinations work?

• ONTAP 9 Event Notification Destinations control the delivery of EMS Event Messages that have been collected by an EMS Event Filter.
• The destinations can be email addresses, syslog servers, SNMP traphosts, or REST .API Servers. 
• By default, the only EMS Event Notification Destination is the built-in ' snmp-traphost', which is not removable, and maps to the SNMP traphost configuration found in 'system snmp traphost', which can be configured separately (or not at all). 

• You can create additional custom event destinations by running the following command:

• The Custom EMS Event Notification Destination for syslog has the IP address 1.2.3.4.
• Notice, the event notification destination type 'email' has a note in parenthesis that shows the mail server and the source email address as configured in event config:

How do EMS Event Notifications work?

• EMS Event Notifications define maps between the payload collected in an EMS Event Filter and delivery targets defined in EMS Event Notification Destinations.
• By default, there is one EMS Event Notification preconfigured to map the built-in default-trap-events EMS Event Filter to the built-in snmp-traphost EMS Event Notification Destination. If desired, this default EMS Event Notification can be removed.

• When creating an EMS Event Notification, specify exactly one EMS Event Filter and one or more EMS Event Notification Destinations. The EMS Event Message will automatically be translated into the appropriate format for each EMS Event Notification Destination depending on the type, either email, SNMP, syslog event message, etc. 

• An EMS Event Filter can be referenced in multiple EMS Event Notifications, and there can be redundancies introduced if care is not taken:

• If you delete an EMS Event Filter, any corresponding EMS Event Notifications will be deleted as well.
• If you delete an EMS Event Notification Destination, it will automatically be removed from any EMS Event Notifications (and if it is the last defined EMS Event Destination, the EMS Event Notification will also be deleted):