Health, Alerting, and Event Management
This domain tests whether you can find the right evidence for an alert and tell an array event from a user action.
Two logs, two purposes
- Event log (
symevent list -sid 123): array-generated events such as hardware faults, SLO non-compliance, SRDF state changes, snapshot expiry and port errors. Filter by severity, time window and object. - Audit log (
symaudit list -sid 123): who did what, for example masking view creation, device deletion or login. "Who removed the volume?" is an audit question, not an event question.
Health surfaces
- Unisphere dashboards show array health, component status, capacity and performance exceptions and the alert list.
symhealth list -sid 123reports component-level health from the command line.symcfg listconfirms arrays are known and reachable;symcfg showon directors, ports and RA groups confirms link states, which distinguishes a host path problem from an array fault.
Alerting configuration
- Notification targets: email, SNMP traps and syslog, configured per Unisphere instance.
- Threshold-based alerts: SRP and storage group capacity thresholds, SLO compliance, SRDF link state and lag, and component health.
- Call Home / remote support connectivity and CloudIQ telemetry (where enabled) carry alerts off the array so support sees faults before users do.
Worked example
One of several hosts reports "device not ready", while other hosts on the same storage group are fine. You filter the event log for that array to the last hour and see SCSI errors tied to a single front-end port. symcfg show on that port shows it is not online, and other ports in the port group are healthy. Reasoning: a single host plus a single port plus a healthy port group points to a fabric or cable path failure, not an array fault and not a storage group problem. The fix belongs with the SAN team; escalating as an array outage would be wrong.
Traps
- Treating the event log as an audit trail, or the audit log as fault evidence.
- Silencing alerts by raising thresholds instead of addressing the underlying condition.
- Assuming alerts are array-wide when thresholds are set per SRP, storage group or link.
- Ignoring informational events that precede a failure, such as repeated link resets.
- Diagnosing a single-path failure as a device or storage group fault.