Gathering and forwarding E-Series SANtricity Major Event Log (MEL)

E-Series Performance Analyzer (EPA) can collect MEL (Major Event Log) events and send them to InfluxDB. I think SANtricity syslog events have similar information.

To get MEL events from the SANtricity API we query the API:

curl -X GET \
  "https://${API_IP}:8443/devmgr/v2/storage-systems/${SYSID}/mel-events?startSequenceNumber=-1&count=100&critical=false&includeDebug=false" \
  -H  "accept: application/json"

• startSequenceNumber - -1 from the beginning
• count - number of events (max = 8192)
• critical - include critical only
• includeDebug - include debug info

EPA gathers MEL information the same way.

I’m not sure if this issue with multipathing is gathered when MEL is enabled or always, but I first saw it today. (I always forget to inspect the raw data and I made the same mistake this time.)

MEL collection is enabled with --showMELMetrics and MEL details - if any - show in a table in System View Dashboard (in EPA v3.0.0):

The System Failures table (to the right) is currently empty. It may be that only "critical": "true"-tagged MEL events are shown in that table, which is why it was empty. (Next time I have to remember to check the raw data…)

The MEL table in the screenshot contains only non-critical events, including multiple failed attempts to authenticate against the SANtricity API or Web UI which resulted in a lockout (600 seconds with SANtricity 11.74).

The EPA’s System dashboard doesn’t let us search MEL events. For that and other reasons it would be better to send MEL data to an indexed document database such as Elasticsearch. EPA v3.0.0 supports only InfluxDB v1 but Elasticsearch supports syslog, so the easiest alternative to gathering MEL data without writing new code or modifying EPA is to forward SANtricity logs to a syslog server.

The second easiest option is to improve EPA and optionally send MEL to Elasticsearch instead, or also to Elasticsearch (in addition to InfluxDB v1).