ALM-12001 Audit Log Dumping Failure

Alarm Description

Cluster audit logs need to be dumped on a third-party server due to the local historical data backup policy. The system starts to check the dump server at 3 a.m. every day. If the dump server meets the configuration conditions, audit logs can be successfully dumped. This alarm is generated when the audit log dump fails if the disk space of the dump directory on the third-party server is insufficient or a user changes the username, password, or dump directory of the dump server.

Alarm Attributes

Alarm Parameters

Impact on the System

System can store a maximum of only 50 dump files locally. If the fault persists on the dump server, the local audit logs may be lost, and the first 50 audit logs that exceed the current time cannot be queried.

Possible Causes

• The network connection is abnormal.
• The username, password, or dump directory of the dump server does not meet the configuration conditions.
• The disk space of the dump directory is insufficient.

Handling Procedure

Check whether the network connection is normal.

1. On the FusionInsight Manager home page, choose Audit > Configurations.
2. Check whether the SFTP IP on the dump configuration page is valid.
   Log in to the node where Manager is located as user root and run the ping command to check whether the network connection between the SFTP server and the cluster is normal.

   • If yes, go to 5.
   • If no, go to 3.

3. Repair the network connection, reset the SFTP password, and click OK.
4. Wait for 2 minutes and check whether the alarm is cleared.
   • If yes, no further action is required.
   • If no, go to 5.

Check whether the username, password, or dump directory are correct.

5. On the dump configuration page, check whether the username, password, and dump directory of the third-party server are correct.
   • If yes, go to 8.
   • If no, go to 6.

6. Change the username, password, or dump directory, reset the SFTP password and click OK.
7. Wait for 2 minutes and check whether the alarm is cleared.
   • If yes, no further action is required.
   • If no, go to 8.

Check whether the disk space of the dump directory is sufficient.

8. Log in to the third-party server as user root and run the df command to check whether the disk space of the dump directory of the third-party server exceeds 100 MB.
   • If yes, go to 11.
   • If no, go to 9.

9. Expand disk space capacity for the third-party server, Reset the SFTP password and click OK
10. Wait for 2 minutes, view real-time alarms and check whether the alarm is cleared.
    • If yes, no further action is required.
    • If no, go to 11.

Reset the dump rule.

11. On the FusionInsight Manager home page, choose Audit > Configurations.
12. Reset dump rules, set the parameters properly, and click OK.
13. Wait for 2 minutes, view real-time alarms and check whether the alarm is cleared.
    • If yes, no further action is required.
    • If no, go to 14.

Collect fault information.

14. On the FusionInsight Manager, choose O&M>Log > Download.
15. Select OmmServer from the Service and click OK.
16. Click in the upper right corner, and set Start Date and End Date for log collection to 10 minutes ahead of and after the alarm generation time, respectively. Then, click Download.
17. Contact the O&M engineers and send the collected log information.

Alarm Clearance

After the fault is rectified, the system automatically clears this alarm.

Related Information

None.