Exporting the Logs

Export the logs that are created after you build a Universal DSM.

Typically you want a significant number of logs for review. Depending on the EPS rate of the unsupported log source, it might take several hours to obtain a comprehensive log sample.

When JSA can't detect the log source type, events are collected, but are not parsed. You can filter on these unparsed events and then review the last system notification that you received. After you reviewed the system notification, you can create a search that is based on that time frame.

1. To look at only the events that are not parsed, filter the logs.

   1. Click the Log Activity tab.

   2. Click Add Filter.

   3. Select Event is Unparsed.

      Tip

      Type inside the Parameter text box to see the Event is Unparsed item.

   4. Select a time frame.

   5. If you see Information events from system notifications, right-click to filter them out.

   6. Review the Source IP column to determine what device is sending the events.

      You can view the raw event payloads. Typically, manufacturers put identifiable product names in the headers, so you can set your search to Display: Raw Events to show the payloads without having to manually open each event. Sorting by network can also help you find a specific device where the event originated from.

2. Create a search for exporting the logs.

   1. From the Log Activity tab, select Search >Edit Search.

   2. For the Time Range, specify as enough time, for example 6 hours, from when the log source was created.

   3. Under Search Parameters, from the Parameter list, select Log Source (Indexed), from the Operator list, select Equals, and from the Log Source Group list, select Other, specify the log source that was created when you built the Universal DSM.

      

      Note

      Depending on your settings, you might see Log Source in the Parameter list instead of Log Source (Indexed).

   4. Click Search to view the results.

3. Review the results in the console to check the payload.
4. Optionally, you can export the results by clicking select Actions >Export to XML > Full Export (All Columns).

   Don't select Export to CSV because the payload might be split across multiple columns, therefore making it difficult to find the payload. XML is the preferred format for event reviews.

   1. You are prompted to download a compressed file. Open the compressed file and then open the resulting file.

   2. Review the logs.

      Event payloads are between the following tags:

      The following code shows an example payload:

      A critical step in creating a Universal DSM is reviewing the logs for usability. At a minimum, the logs must have a value that can be mapped to an event name. The event name must be a unique value that can distinguish the various log types.

      The following code shows an example of usable logs:

      The following codes shows an example of slightly less usable logs: