prelude-lml-rules 4.1.0-1 / etc / prelude-lml / ruleset / netapp-ontap.rules

#FULLNAME: NetApp ONTAP
#VERSION: 1.0
#DESCRIPTION: Data ONTAP is NetApp's internal operating system, specially optimised for storage functions at high and low level. The rules included here were developed using NetApp ONTAP 6.4.4R1 on a F820 Filer.

#####
#
# Copyright (C) 2004 G Ramon Gomez <gene at gomezbrothers dot com>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####

#DESCRIPTION:Storage full
#CATEGORY:Monitoring
#LOG:Jul 22 12:12:57 cahco3 Thu Jul 22 12:09:00 PDT [monitor.globalStatus.nonCritical:warning]: /vol/RanchoFiles is full (using or reserving 98% of space and 6% of inodes).
regex=\[monitor.globalStatus.nonCritical:warning\]: (\S+) is full \(using or reserving (\d+%) of space and (\d+%) of inodes; \
 classification.text=Storage capacity warning; \
 id=3900; \
 revision=1; \
 analyzer(0).name=ONTAP; \
 analyzer(0).manufacturer=NetApp; \
 analyzer(0).class=Storage; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=The storage on volume $1 is either approaching or has reached full capacity.  $2 of available storage and $3 of available inodes have been consumed.; \
 last

#DESCRIPTION:Directory close to the maxdirsize limit
#CATEGORY:Monitoring
#LOG:Jul 15 13:21:04 cahco3 Thu Jul 15 13:17:16 PDT [FastEnet-10/100/e0:warning]: Directory /vol/Imaging/idmds/MAXLIB01/stacks/shelf006/ is getting close to the maxdirsize limit. Please increase the maxdirsize by using the vol option command.
regex=Directory (\S+) is getting close to the maxdirsize limit; \
 classification.text=Storage capacity warning; \
 id=3901; \
 revision=1; \
 analyzer(0).name=ONTAP; \
 analyzer(0).manufacturer=NetApp; \
 analyzer(0).class=Storage; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=The directory $1 is either approaching or has reached full capacity.; \
 last

#DESCRIPTION:HTTP Authentication failed
#CATEGORY:Authentication
#LOG:Jul 15 10:55:40 cahco3 Thu Jul 15 10:51:52 PDT [httpd_slowproc:warning]: HTTP Authentication from 12.34.56.78 to realm Administration failed
regex=\[httpd_slowproc:warning\]: HTTP Authentication from ([\d\.]+) to realm \w+ failed; \
 classification.text=Web administration admin login; \
 id=3902; \
 revision=2; \
 analyzer(0).name=ONTAP; \
 analyzer(0).manufacturer=NetApp; \
 analyzer(0).class=Storage; \
 assessment.impact.severity=high; \
 assessment.impact.completion=failed; \
 assessment.impact.type=admin; \
 assessment.impact.description=A failed attempt was made to log into the ONTAP web administration console.; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$1; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.name=http; \
 last

#DESCRIPTION:Remote Login
#CATEGORY:Authentication
#LOG:Jul 15 10:57:55 cahco3 Thu Jul 15 10:54:07 PDT [telnet_0:info]: clark logged in from host: localhost
regex=\[telnet_\d+:info\]: (\S+) logged in from host: ([\w\-\.]+); \
 classification.text=Remote control admin login; \
 id=3903; \
 revision=2; \
 analyzer(0).name=ONTAP; \
 analyzer(0).manufacturer=NetApp; \
 analyzer(0).class=Storage; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=A user logged into the NetApp Filer using telnet.; \
 source(0).service.iana_protocol_name=tcp; \
 source(0).service.iana_protocol_number=6; \
 source(0).node.name=$1; \
 target(0).user.category=os-device; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).service.iana_protocol_name=tcp; \
 target(0).service.iana_protocol_number=6; \
 target(0).service.name=telnet; \
 last

#DESCRIPTION:Addition of disk success
#CATEGORY:Monitoring
#LOG:Jul 15 11:20:49 cahco3 Thu Jul 15 11:17:01 PDT [raid.vol.disk.add.done:notice]: Addition of disk 8.64 (S/N 3HZ6YQHN00007433ARFV) to volume Callrec has completed successfully
regex=\[raid.vol.disk.add.done:notice\]: Addition of disk ([\d\.]+) \(S\/N (\S+)\) to volume (\S+) has completed successfully; \
 classification.text=Storage disk added to RAID; \
 id=3904; \
 revision=1; \
 analyzer(0).name=ONTAP; \
 analyzer(0).manufacturer=NetApp; \
 analyzer(0).class=Storage; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Disk $1 with serial $2 was added to volume $3.; \
 last

#DESCRIPTION:Disk zeroing complete
#CATEGORY:Monitoring
#LOG:Jul 15 11:39:59 cahco3 Thu Jul 15 11:36:11 PDT [raid.disk.zero.done:notice]: 8.34 (S/N 3FP0H0JE000072074RFP): disk zeroing complete
regex=\[raid.disk.zero.done:notice]: ([\d\.]+) \(S\/N (\S+)\): disk zeroing complete; \
 classification.text=Storage disk zeroed; \
 id=3905; \
 revision=1; \
 analyzer(0).name=ONTAP; \
 analyzer(0).manufacturer=NetApp; \
 analyzer(0).class=Storage; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=other; \
 assessment.impact.description=Disk $1 with serial $2 was zeroed.; \
 last