GET /events/csv/auditLog

Use the GET method to retrieve the audit log in .CSV format.

Authentication

Authentication with user name and password is required.

Request URL

GET https://<management_server_IP>/events/csv/auditLog

Query parameters

Parameters Required / Optional Description
filterWith=<filter> Optional Returns only the events that apply to the specified filters (see Filtering events).

Request header

Attributes Required / Optional Description
Range Optional Request the events with the given range of sequence numbers. If the range goes beyond the actual available sequence numbers, the start of the range through the last sequence number is returned. For example:
GET /events
Range: item=0-24
--------
Response Header:
Content-Range: 0-24/3000
Note: When retrieving events from Lenovo XClarity Administrator, use the sequence numbers to verify that no events are missing. If the sequence number of an event is not sequential with that last event that you retrieved for the target device, perform another GET /events to request the events that are associated with all the sequence numbers that you missed.

Response codes

Code Description
200 OK. Accepted for processing to Lenovo XClarity Administrator log.
400 Bad request. The request that was sent by the client was syntactically incorrect.
401 Unauthorized. The user could not be authenticated.
500 Internal server error. An internal error occurred.

Response body

The response body contains .CSV data. The key definitions are listed in the following table.

Attributes Type Description
action Integer Action category. This can be one of the following values.
  • 100. NONE
  • 200. TOPOLOGY
  • 300. IP
  • 400. INVENTORY

If not available, an empty string is returned.

args Array of string List of dynamic arguments in the event message string. If not available, an empty string is returned.

If not available, an empty string is returned.

bayText String  
chassisText String  
cn String Event Sequence number. It is the order in which the events were processed.
commonEventID String Common event ID.
componentID Array of string Unique ID of the component on which the event occurred.

If not available, an empty string is returned.

componentIdentifierText String The component description. This can be one of the following values.
  • Canister/Appliance

  • Client Data Storage Device

  • Cooling

  • Device Driver

  • Display

  • Hypervisor

  • I/O connectivity

  • Interconnect (Fabric)

  • Interconnect (Interfaces)

  • Interconnect (Networking)

  • Interconnect (PCI Manager)

  • Interconnect (PIE)

  • Interconnect (Utilities / Infrastructure)

  • Memory

  • OS

  • OS/Hypervisor Interface

  • Power

  • Processing

  • Storage RAID

  • System board

  • Systems Management

  • Time Reference

  • Unknown

  • Vendor Events

  • VPD

decriptionArgs Array of strings List of dynamic arguments in the event message description.

If not available, an empty string is returned.

eventClass Integer The source of the event. This can be one of the following values.
  • 50. Unknown
  • 200. Audit
  • 300. Cooling
  • 400. Power
  • 500. Disks (storage)
  • 600. Memory
  • 700. Processor
  • 800. Rack or tower server
  • 900. Test
  • 1000. Adapter card
  • 1100. Expansion board
  • 1200. Flex System switch
  • 1300. Flex System server
  • 1400. switch

If not available, an empty string is returned.

eventDate String Time and date that the event was created on source system. This is the time and date from the managed system and might be quite different from timeStamp, which is when the event was processed by the Lenovo XClarity Administrator. The string is in ISO-8601 format:
yyyy-MM-dd'T'HH:mm:ss'Z'
eventID String Event ID is a unique identifier for each event supported by a product.
eventSourceText String  
failFRUNames Array of strings For hardware fault events, includes names of one or more FRUs that are associated with the fault.

If not available, an empty string is returned.

failFRUPartNumbers Array of strings For hardware fault events, includes part numbers for one or more FRUs that are associated with the fault.

If not available, an empty string is returned.

failFRUs Array of strings For hardware fault events, includes FRU numbers for one or more FRUs that are associated with the fault.

If not available, an empty string is returned.

failFRUUUIDs Array of strings For hardware fault events, includes UUIDs for one or more FRUs that are associated with the fault.

If not available, an empty string is returned.

failSNs Array of strings For hardware fault events, includes serial numbers for one or more FRUs that are associated with the fault.

If not available, an empty string is returned.

flags Array of strings Proprietary event flag definitions. This can be one of the following values.
  • Hidden. The event not to be displayed in normal log views. It is displayed only for diagnostic views.
  • Historical. The event occurred while the management server was down and can be ignored by EventActions.
  • Ignored. The event is ignored.
  • Recovered. The event was involved in the reliable event recovery process.
  • Unsequenced. Switch system traps are not sequenced. Reliable event recovery is skipped.
  • VM. VM Migration (Blade "Trust the Source Logging Model")

If not available, an empty string is returned.

fruSerialNumberText String  
groupName Array of strings List of resource-groups, by name, to which the source of the event belongs. If the source does not belong to a resource group, the value is "Not Available."
groupUUID Array of strings List of resource-groups, by UUID, to which the source of the event belongs.
localLogID String Log type. This can be one of the following values.
  • AUDIT. Audit events
  • EVENT. All other events.
localLogSequence Integer Log Sequence Number, which uniquely identifies this event on the audit or event log

If not available, an empty string is returned.

location String Location information for event association in the format of "Slot#01."
msg String Event message string.
msgID String Event message ID.
mtm String System machine type and model of the managed system on which the event occurred.
originatorUUID String The unique ID of the managed system on which the event occurred.
Attributes Object Reserved.

If not available, an empty string is returned.

senderUUID String  
serialnum String Serial number of system generating the event (event source). Not set for internal events.
service Integer Identifer that specifies how service is performed. It can be one of the following.
  • 100. Not Serviceable.
  • 200. Serviceable by Lenovo (called home)
  • 300. Serviceable by the customer

If not available, an empty string is returned.

serviceabilityText String  
severity Integer Severity. This can be one of the following values.
  • 100. Unknown. The severity is unknown.
  • 200. Informational. Informational
  • 300. Warning. User can decide if action is needed.
  • 400. Minor. Action is needed, but the situation is not serious at this time.
  • 500. Major. Action is needed now.
  • 600. Critical. Action is needed now and the scope is broad (perhaps an imminent outage to a critical resource will result).
  • 700. Fatal. A non-recoverable error has occurred.

If not available, an empty string is returned.

severityText String Severity text. This can be one of the following values.
  • Unknown. The severity is unknown.
  • Informational. Informational
  • Warning. User can decide if action is needed.
  • Minor. Action is needed, but the situation is not serious at this time.
  • Major. Action is needed now.
  • Critical. Action is needed now and the scope is broad (perhaps an imminent outage to a critical resource will result).
  • Fatal. A non-recoverable error has occurred.

If not available, an empty string is returned.

sourceID String System UUID for the system or device that is/was the event source (raiser/owner)
sourceLogID String Identifier of log of event source system. System may have multiple logs for events and this identifier is used with the System Log Sequence Number for reliable event support.
sourceLogSequence Integer Source Log Sequence Number, uniquely identifies this event in source Log ID
systemFruNumberText String  
systemName String System identifier. It correlates to the display name used for the device on the CMM.
systemSerialNumberText String  
systemText String  
systemTypeModelText String  
systemTypeText String  
timeStamp String Time and date of when the log entry was created for the Lenovo XClarity Administrator log. The string is in ISO-8601 format (for example, yyyy-MM-dd'T'HH:mm:ss'Z').
typeText String  
userActionArgs Array of strings List of dynamic arguments in the event message action

If not available, an empty string is returned.

userid String For internal audit events, this is the associated user ID. This is not available for external events.
userIDIndex Integer  

Response example

The following table is returned:

"Sequence ID", "Type", "Severity", "Time Stamp", "Source ID", "Originator UUID", "Component ID",
"Source Log ID", "Local Log ID", "Local Log Sequence", "Event Code", "Event Date", "Message ID",
"Event Message", "Serial Number", "Mtm", "Service", "Action", "Location", "User ID", 
"Source Log Sequence", "Flags", "Fail SNs", "Fail FRUs",

"151", "SYSTEM", "INFORMATIONAL", "1424290017496", "63E29269BB634AB9A610D6F8FCE2B28F", "", 
"4378eb1f6cf111e4bf1fb0ffa5d3ca74", "LENOVO:CMM01:Y030BG4BA020:01", "EVENT", "83", "0001608C", 
"1423627952000", "CMM0207", "SSH host key auto-generation started.", "", "", "NONE", "", 
"01010201", "", "14707", "Recovered", "", ""