NetApp AltaVault AVA400, Administration Manual

Page: 150 / 276

150
NetApp AltaVault Cloud Integrated Storage Administration Guide
Beta Draft
Viewing reports and logs Capturing and uploading TCP dumps
Stopping a TCP dump after an event occurs
TCP dumps offer visibility into intermittent network issues, but the amount of traffic they capture can be
overwhelming. Be aware that automated log rotation on the AltaVault can overwrite debugging information specific
to the event.
To limit the amount of data collected, you can use a trigger to stop a continuous TCP dump after a specific log event
occurs. The stop trigger continuously scans the system logs for a search pattern. The result is a smaller file to help
pinpoint what makes the event happen.
The stop trigger continuously scans the system logs for a search pattern. When it finds a match, it stops all running
captures.
To stop a TCP dump after a specific log event
1. Choose Maintenance > TCP Dumps.
2. Add a new TCP dump and schedule it to run. For more details about adding a TCP Dump, see “To capture TCP
trace dumps” on page 146 .
3. Scroll down to the TCP Dump Stop Trigger section on the TCP Dumps page.
4. In the Pattern text box, enter a Perl regular expression (regex) to find in a log. The system compares the Perl regex
against each new line in the system logs and the trigger stops if it finds a match.
The simplest regex is a word or a string of characters. For example, if you set the pattern to “Limit,” the trigger
matches the line “Connection Limit Reached.”
Notes:

Perl regular expressions are case-sensitive.

Perl treats the space character “ \space “ like any other character in a regex.

Perl reserves some characters, called metacharacters, for use in regex notation. The metacharacters are:
{ } [ ] ( ) ^ $ . | * + ? \
You can match a metacharacter by putting a backslash before it. For example, to search for a backslash in the
logs, you must enter two backslashes (\\) as the pattern.

The pattern follows Perl regular expression syntax. For details, go to:
http://perldoc.perl.org/perlre.html

You cannot change the pattern while a scan is running. You must stop the scan before changing a pattern.

You do not need to wrap the pattern with the metacharacters to match the beginning or end of a line (^ $) or
with the wildcard character (*).
5. Specify the amount of time to pause before stopping all running captures when the system finds a match. This gives
the system some time to log more data without abruptly cutting off the capture. The default is 30 seconds. Specify
0 for no delay; the capture stops immediately.
After a trigger has fired, the capture can stop by itself before the delay expires. For example, the capture duration
can expire.
6. Click Start Scan .
When the scan stops, the system sends an email to all email addresses on the Configure > Email page appearing
under Report Events via Email. The email notifies users that the trigger has fired.