Deployment Architecture

How to add the logs of EMC unity storage to splunk?

ahmedzard
Explorer

I want to integrate EMC unity 500 storage with Splunk, to be able to see its logs on Splunk, so how can I do that?

poulost
Engager

I opened a ticket with EMC and they informed me that "Remote Logging" are only logs that can be sent directly off the Unity platform. There is no way of gathering performance or capacity data that is supported by Dell/EMC.

0 Karma

ralphwu15
New Member

There are two different logs. Unity system logs can be sent to from Unity to a remote syslog server.

File system audit logs can be pushed out from the Unity using the CEE framework to a host. Another method would be to monitor the security.evt file on the Unity that holds the audit entries. The file is located \unity_netbios_name\C$\security.evt.

Page 33 of https://www.emc.com/collateral/TechnicalDocument/docu69322.pdf has the instructions on how to enable file system auditing.

0 Karma

tpetersonalpine
Explorer

I've been told EMC Common Event Enabler (CEE) Framework is required for Unity
https://github.com/damiendallimore/SplunkModularInputsPythonFramework/tree/master/implementations/ce...

Not true?

0 Karma

ralphwu15
New Member

Unity supports sending logs to syslog. Did you have issues configuring that?
https://www.dellemc.com/en-us/documentation/unity-family/unity-p-security-config-guide/03-vxe-c-sec-...

0 Karma

GaryChan1
Engager

Hi @ahmedzard - did you end up working this out? I'm looking to do the same.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...