Report on Celerra CIFS Server as Windows Event NIC device
I'm collecting logs from a CELERRA CIFS Server. The logs are collected successfully like a Windows Event NIC agentless device type but the XML parser don't undestand the logs and I can't report on them.
RSA Support said their developers website is down for two weeks and they can't answer me...
By looking at the raw events the only one difference is this:
Original Windows Event Nic events begins like %NICWIN-4-Security_560_Security
Celerra events begins like %CELERRA-4-Security_560_Security
The rest of the event is exactly the same.
Do you have any idea on how to solve this?
I tried to add a few lines in wineventnic_msg.xml replacing NICWIN with CELERRA but it didn't work.
Even though envision usee NIC windows service to pull down celerra logs, I believe these logs should be parsed by the celerra xml and not the windows xml. You can try parsing these logs with celerra xml it should work.
Hello and thank you for the reply.
I can't see any Celerra reports category in ad-hoc reports. I tried running all the reports inside the Storage category but none of them returned results.
How can I say enVision to use that parser instead of the WindowsNIC one?
Shall I change the device type from Windows NIC to Celerra?
I originally was of the thinking that celerra messages should get recognised as EMC celerra device type, in your case you can change the device type manually to Celerra so that the messages parse. To my knowledge Celerra doesnot have any device specific reports, the class specific reports under the storage category should give celerra data, not really sure though. Hope this helps!!
We solved this problem changing the devicetype from Windows to Celerra. Logs are still collected using the Windos Event NIC (Agentless) and reported as Celerra.
Thank you for your replies.