Extracted fields describe syslog message fields simplifying the process of searching, identifying and understanding the content of FlashArray generated events. Log Insight provides a comprehensive set of indicators to describe a field which are called regular expressions. Generally, FlashArray messages follow a certain pattern which can be searched using regular expressions. The Everpure Content Pack provides forty extracted fields. Details of each described field including regular expression can be viewed from Log Insight Content Packs pane. See Figure 8.
Figure 8.
Extracted fields are also displayed in Interactive Analytics where Log Insight automatically highlights associated part of FlashArray syslog message when mousing over the extracted field. See Figure 9.
Figure 9.
The following fields are extracted and included in Everpure Content Pack:
|
Extracted Field |
Description |
|---|---|
|
pure_access_ip |
IP address of the host accessing FlashArray. |
|
pure_access_mode |
FlashArray access method (CLI, GUI, RestAPI) utilized to manage array. |
|
pure_admin_operation |
Administrative commands invoking FlashArray configuration changes (not involving hosts and volumes) |
|
pure_alert_action |
Suggested action to be taken based on condition reported. |
|
pure_alert_code |
Numeric value associated with an alert. The alert codes may be viewed at https://support.purestorage.com |
|
pure_alert_detail |
Additional details, when available associated with an alert. |
|
pure_alert_message |
Message describing alert. |
|
pure_alert_severity |
Alert severity: Info, Reminder, Warning, Critical. Alerts with critical severity require immediate attention. |
|
pure_array_name |
FlashArray name. |
|
pure_audit_user |
Name of the user accessing or name of the user used to access FlashArray. |
|
pure_cli_command |
Command executed on FlashArray. |
|
pure_controller_name |
FlashArray controller: ct0 or ct1. |
|
pure_controller_sn |
Serial number of the FlashArray controller. |
|
pure_delayed_pgroup |
Protection group which experienced delayed replication. |
|
pure_event_type |
FlashArray event type: audit, alert, test. |
|
pure_failed_hardware |
Failed hardware component such as controller, SSD, power supply. |
|
pure_hgroup_name |
Host group name. |
|
pure_hgroup_operation |
Operation executed against the indicated host group. |
|
pure_host_name |
Name of the altered host in the indicated operation. |
|
pure_host_operation |
Host operation such as create, connect, disconnect, delete, setattr, remove. |
|
pure_hostvol_name |
Volume or volume group which has been connected or disconnected from host. |
|
pure_object_setattr |
FlashArray or FlashArray's object which had its attribute modified. |
|
pure_percent_full |
Percentage of consumed FlashArray usable capacity. Reported when 80% (Info), 90% (Warning), 100% (Critical) of storage capacity is exceeded. |
|
pure_pgroup_name |
Protection group name. |
|
pure_pgroup_objectname |
Protection group object or list of objects managed such as volume, host, host group, target FlashArray. |
|
pure_pgroup_operation |
Protection group operation such as create, destroy, enable, disable, destroy, eradicate, recover, rename, snamp, schedule, setattr. |
|
pure_pod_name |
ActiveCluster Pod name. |
|
pure_pod_operation |
ActiveCluster Pod operation such as create , add, clone, destroy, eradicate, recover, remove, rename, setattr. |
|
pure_purity_version |
Version of Purity on FlashArray. |
|
pure_replicate_frequency |
Protection group replication frequency. |
|
pure_snapshot_frequency |
Protection group snapshot frequency. |
|
pure_user_name |
User name executing operation on FlashArray. |
|
pure_vgroup_operation |
Volume group operation such as create, destroy, eradicate, rename, recover. |
|
pure_vmvol_name |
Name on the FlashArray for VVol-based virtual machine and corresponding volume group. |
|
pure_volume_name |
Volume name or volume_group/volume_name |
|
pure_volume_operation |
Volume operation such as create, copy, destroy, disconnect, eradicate, move, recover, remove, rename, setattr, snap. |
|
pure_vvol_name |
Volume name for VVol-based virtual machine volume. |
|
pure_vvol_operation |
VVol (volume) operation such as connect, snap, destroy, eradicate. |
|
pure_vvolvg_name |
Volume group name. |
Table 2.