Example 13-5 shows an expanded format syslog message. 

IBM2076 #NotificationType=Error #ErrorID=077102 #ErrorCode=1091 #Description=Node Double fan failed #ClusterName=V7000G2_1 #Timestamp=Wed Jul 02 08:00:00 2017 BST #ObjectType=Node #ObjectName=Node1 #CopyID=0 #ErrorSequenceNumber=120 #ObjectID=2 #NodeID=2 #MachineType=2076624#SerialNumber=1234567 #SoftwareVersion=8.1.0.0(build 13.4.1709291021000)#FRU=fan 31P1847 #AdditionalData(0->63)=00000000460000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000#Additional Data(64-127)=000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000 

## 13.8 Audit log 

The audit log is useful when analyzing past configuration events, especially when trying to determine, for example, how a volume ended up being shared by two hosts or why the volume was overwritten. The audit log is also included in the svc_snap  support data to aid in problem determination. 

The audit log tracks action commands that are run through an SSH session, through the management GUI, or Remote Support Assistance. It provides the following entries: 

GLYPH<SM590000> Identity of the user who ran the action command 

GLYPH<SM590000> Name of the actionable command 

GLYPH<SM590000> Time stamp of when the actionable command was run on the configuration node 

GLYPH<SM590000> Parameters that were run with the actionable command 

The following items are not documented in the audit log: 

GLYPH<SM590000> Commands that fail are not logged. 

GLYPH<SM590000> A result code of 0 (success) or 1 (success in progress) is not logged. 

GLYPH<SM590000> Result object ID of node type (for the addnode  command) is not logged. 

GLYPH<SM590000> Views are not logged. 

Several specific service commands are not included in the audit log: 

GLYPH<SM590000> dumpconfig 

GLYPH<SM590000> cpdumps 

GLYPH<SM590000> cleardumps 

GLYPH<SM590000> finderr 

GLYPH<SM590000> dumperrlog 

GLYPH<SM590000> dumpintervallog 

GLYPH<SM590000> svcservicetak dumperrlog 

GLYPH<SM590000> svcservicetask finderr 

