Table of Contents 1. Alarm Codes...2

Transcription

1 Table f Cntents 1. Alarm Cdes...2 1

2 2 1. Alarm Cdes Hme Tp SCA0001 SCA0002 SCA0003 SCA0005 SCA0006 SCA0007 SCA0008 SCA0009 SCA0010 SCA0011 SCA0012 SCA0013 SCA0014 SCA0015 SCA0016 SCA0017 SCA0018 SCA0019 SCA0020 SCA0021 SCA0022 SCA0023 SCA0024 SCA0025 SCA0026 SCA0027 SCA0028 SCA0029 SCA0030 SCA0031 SCA0032

3 3 SCA0033 SCA0034 SCA0035 SCA0036 SCA0037 SCA0038 SCA0039 SCA0040 SCA0041 SCA0042 SCA0043 SCA0044 SCA0045 SCA0047 SCA0046 SCA0049 SCA0050 SCA0051 SCA0052 SCA0053 SCA0054 SCA0055 SCA0056 SCA0057 SCA0058 RSW0018 SCA0060 RSW0001 RSW0002 RSW0003 RSW0004 RSW0005 RSW0006 ECA0007 RSW0008

4 4 RSW0009 RSW0010 RSW0011 RSW0012 RSW0024 RSW0013 RSW0014 RSW0015 RSW0016 SCA0061 SCA0062 SCA0063 SCA0064 SCA0065 SCA0066 RSW0021 RSW0022 SCA0069 EAU0004 EAU0003 EAU0005 SCA0070 SCA0071 RSW0017 RSW0020 ECA0002 ECA0001 ECA0003 ECA0004 ECA0005 ECA0006 EAU0006 EAU0007 ES0001 EAU0008

5 DRSDEDGE0001 SCA0073 SCA0001 GENERIC_ALARM (Cde.SCA0001) descriptin = "Errr within the SCA service."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This cvers all unknwn errrs that have n mre specific errrs. SCA0002 INVALID_SRC_DST_CONFIGURATION(Cde.SCA0002) descriptin = "Fund a replicatin jb where either the surce r destinatin is nt a managed netwrk element."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: 5 Prblem: This alarm will ccur when an Eyeglass cnfiguratin replicatin Jb fails t run because is assciated with an Isiln cluster that has nt been prvisined in Eyeglass. The Eyeglass cnfiguratin replicatin Jbs are created based n the SyncIQ plicies discvered during the Eyeglass Inventry task. It is pssible that an Isiln cluster prvisined in Eyeglass culd have SyncIQ plicies that have Isiln cluster targets that are nt prvisined in Eyeglass. Reslutin: Prvisin Eyeglass with all Isiln clusters related t Eyeglass cnfiguratin replicatin Jbs If nt all Isiln clusters assciated with Eyeglass cnfiguratin replicatin Jbs can be managed by Eyeglass, disable Eyeglass cnfiguratin replicatin Jbs assciated with Isiln clusters nt managed by Eyeglass t

6 avid the errr SCA0003 INVENTORY_FAILED(Cde.SCA0003) descriptin = "Failed t retrieve inventry."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: Prblem: This alarm will ccur when the Eyeglass Inventry task which discvers the cnfiguratin infrmatin n an Isiln cluster has failed t run. Reslutin: Ensure that Isiln clusters are reachable frm Eyeglass server This prblem can als ccur if the Inventry task attempts t start while anther instance f the Inventry task is still running. In this case the prblem will be transient and will clear n it's wn. If this prblem persists, cntact supprt.superna.net fr assistance. If the Inf fr the alarm shws Errr fetching data frm ssh. Inventry may be incmplete there is an issue with retrieving the Inventry infrmatin that requires ssh access. This may be a prblem with the permissins f the Isiln cluster user in Eyeglass. Check the fllwing Ensure that the Isiln cluster user rle in Eyeglass has Netwrk Read/Write permissins Ensure that the Isiln cluster user rled in Eyeglass des nt cntain a - r ther special characters. This can cause an issue with the sud cmmand that is used. T trublesht this cnditin: 1. Lgin t Isiln cluster CLI as Isiln Cluster user that has been prvisined in Eyeglass 2. Execute the cmmand belw it needs t be able t execute withut errr sud isi netwrks list pls Example f successful cmmand executin % sud isi netwrks list pls Subnet Pl SmartCnnect Zne Ranges Allc int-a-subnet int-a-pl Static 6 Example f failed cmmand executin

7 sud isi netwrks list pls sud: >>> /usr/lcal/etc/suders: syntax errr near line 168 <<< sud: parse errr in /usr/lcal/etc/suders near line 168 sud: n valid suders surces fund, quitting sud: unable t initialize plicy plugin REPLICATION_JOB_FAILED(Cde.SCA0004) NOTE: failure fr any prperty f a share, exprt r quta t replicate will stp all replicatin fr that share/exprt/quta. descriptin = "Replicatin jb failed t run."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: Fllwing reasns are cmmnly seen t cause a replicatin jb failure. The Inf related t the alarm shuld be verified t cnfirm the cause: AEC_NOT_FOUND Zne <Zne Name> nt fund. Prblem: This errr is issued when the Eyeglass cnfiguratin replicatin jb runs and attempts t replicate a share r exprt when the assciated Zne des nt exist n the target. Reslutin: Ensure that all Znes assciated with shares and exprts exist n the target. Once the Znes exist, the next cnfiguratin replicatin jb will succeed and the alarm will be cleared AEC_NOT_FOUND "Path 'x/y/z' nt fund: N such file r directry". Prblem: This errr is issued when the Eyeglass cnfiguratin replicatin jb runs and attempts t replicate a share r exprt r quta when the assciated directry des nt exist n the target. Pssible Cause fr Missing Path (Grup 1): SyncQ Plicy assciated with the path has nt been run. Path is n the SyncIQ Plicy Excluded list. SyncIQ Plicy has paths in the included r excluded list and the path that was nt fund is prtected by the plicy but is nt in either list. Reslutin (Grup 1): Ensure that all directries assciated with shares and exprts and qutas exist n the target. Once the Znes exist, the next cnfiguratin replicatin jb will succeed and the alarm will be cleared Pssible Cause fr Missing Path (Grup 2): share path has a trailing "/" at the end f the share path - example /ifs/hme/ Reslutin (Grup 2): We recmmend t remve the trailing "/" frm the path f the 7

8 share t reslve the errr. AEC_EXCEPTION bad hstname <hst name> NFS Exprt Clients field has a hst name entry that cannt be reslved n replicatin f the Exprt AEC_EXCEPTION Cannt set security descriptr n <share path> Read nly file system Yu will receive the abve errr when Eyeglass is nt able t sync share prperties such as ABE (Access based Enumeratin). In this case we recmmend yu t cmpare all prperties f the active cluster share with the target cluster share and make it identical with the surce. SCA0005 FAILED_TO_CONNECT(Cde.SCA0005) descriptin = "Failed t cnnect t the designated target."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: Prblem: This alarm will ccur when Eyeglass cannt establish a cnnectin with an Isiln cluster it is managing. Reslutin: Verify that there have been n change in Isiln credentials which wuld cause Eyeglass prvisining t be ut f date. Verify that there have been n netwrking r firewall changes which wuld result in lss f netwrk cnnectivity between the Eyeglass server and the Isiln clusters. SCA0006 BACKUP_JOB_FAILED(Cde.SCA0006) descriptin = "Failed t create a backup archive."; 8

9 Help n this Alarm: SCA0007 JOB_AUDIT_FAILURE(Cde.SCA0007) descriptin = "Replicatin jb audit failed."; Help n this Alarm: Prblem: The Eyeglass audit task cmpares surce and destinatin cnfiguratin items pst replicatin t cnfirm that the replicatin task has dne it's Jb and that the cnfiguratin items n the surce and target are indeed identical. Replicatin jb audit failed alarm will ccur when: audit jb fails t run audit jb finds cnfiguratin item where surce and target are different Reslutin: Use the Inf related t the alarm aid in reslving the issue audit jb failure t run Inf: Audit f shares fr current jb is incnclusive because surce and target netwrk element are identical. Reslutin: Eyeglass cnfiguratin replicatin Jb has same Isiln cluster cnfigured as surce and target. Eyeglass cannt perfrm replicatin cnfiguratin r the assciated audit with this cnfiguratin. Disable this Jb t avid this alarm. Inf: Audit f jb 'xxx' has failed: Surce and/r target netwrk element were nt fund in prvided list f netwrk elements Reslutin: Surce and target Isiln Clusters in Jb xxx must be managed by Eyeglass fr audit t run. audit jb finds cnfiguratin item where surce and target are different Inf: Audit failed: Values fr key 'xxx' d nt match: surce: share r exprt ; target: share r exprt 9

10 key 'xxx' refers t a prperty f share r exprt where mismatch was fund Inf: Auditable surce (type: 'xxx', zne: 'yyy', name: 'zzz') and target (type: 'xxx', zne: 'yyy', name: 'zzz') bjects nt fund n surce r target cluster, hence audit fails. Auditable surce refers t cnfiguratin item Reslutin: Check that assciated Replicatin Jb was successfully run. If nt, surce and destinatin may indeed be different. and Replicatin Jb issue needs t be reslved. It is pssible that a change t cnfiguratin item was made via OneFS after replicatin Jb cmpleted and befre audit task ran. The next replicatin task will reslve this mismatch. SCA0008 QUOTA_FAILOVER_JOB_FAILED(Cde.SCA0008) descriptin = "Quta failver jb failed."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: SCA0009 BASE_LICENSE_TO_EXPIRE(Cde.SCA0009) prtected AlarmData create(string synckey, String extrainf) { 10 descriptin = "Base license t expire.";

11 severity = AlarmSeverity.WARNING; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA0010 BASE_LICENSE_HAS_EXPIRED(Cde.SCA0010) descriptin = "Base license has expired."; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA0011 DISCOVERY_LICENSE_TO_EXPIRE(Cde.SCA0011) descriptin = "Discvery license t expire."; severity = AlarmSeverity.WARNING; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA

12 DISCOVERY_LICENSE_HAS_EXPIRED(Cde.SCA0012) descriptin = "Discvery license has expired."; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA0013 FEATURE_LICENSE_TO_EXPIRE(Cde.SCA0013) descriptin = "Feature license t expire."; severity = AlarmSeverity.WARNING; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA0014 FEATURE_LICENSE_HAS_EXPIRED(Cde.SCA0014) descriptin = "Feature license has expired."; 12

13 }, Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA0015 MANAGEDOBJECT_LICENSE_TO_EXPIRE(Cde.SCA0015) descriptin = "Managed bject license t expire."; severity = AlarmSeverity.WARNING; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA0016 MANAGEDOBJECT_LICENSE_HAS_EXPIRED(Cde.SCA0016) descriptin = "Managed bject license has expired."; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA

14 SUPPORT_LICENSE_TO_EXPIRE(Cde.SCA0017) descriptin = "Supprt license t expire."; severity = AlarmSeverity.WARNING; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA0018 SUPPORT_LICENSE_HAS_EXPIRED(Cde.SCA0018) descriptin = "Supprt license has expired."; Help n this Alarm: Trial key has expired and can be renewed n the supprt.superna.net site by pening a case with yur appliance id. SCA0019 TRIAL_KEY_LIMITS_REACHED(Cde.SCA0019) descriptin = "Replicatin functinality limited by trial. "; severity = AlarmSeverity.WARNING; 14

15 Help n this Alarm: The trial key has limits applied. Open a case n supprt.superna.net t request higher limits. SCA0020 AUDITTRUSTEE_ISSUE(Cde.SCA0020) descriptin = "Replicatin audit issue with trustee(s)."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: SCA0021 SINGLE_SHARE_MIGRATION_FAILURE(Cde.SCA0021) descriptin = "Single Share Migratin Jb failed."; Help n this Alarm: The migratin jb has encuntered an errr, this errr cde relates t flder migratin feature. The SyncIQ plicy and migratin jb frm running jbs windw shuld be checked fr the failed step and find the inf buttn fr the errr t raise a case with supprt. SCA0022 NO_SUPPORT_LICENSE_INSTALLED(Cde.SCA0022) 15

16 descriptin = "N supprt license has been installed; " + "patches cannt be applied."; Help n this Alarm: This indicates n supprt license key is installed which is required t raise a case fr a prductin appliance. If yu supprt keys have expired a new rder is required t purchase a new supprt cntract. SCA0023 REPLICATION_SOURCE_MATCHES_DESTINATION(Cde.SCA0023) descriptin = Fund a replicatin jb where the surce and " + "destinatin are the same and that replicates shares."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm is expected if a SyncIQ Jb is discvered where the surce and target refer t the same cluster. SCA0024 PREVIOUS_JOB_STILL_RUNNING (Cde.SCA0024) running."; descriptin = "A scheduled task was unable t run as there was anther instance already 16

17 severity = AlarmSeverity.WARNING; Help n this Alarm: This alarm will ccur when there is a replicatin task in prgress at the time when a new replicatin task is scheduled t begin. By default, Eyeglass attempts t begin a new replicatin task every 5 minutes. In the event that cnfiguratin replicatin takes lnger than 5 minutes n yur Eyeglass system yu will see this alarm fr each attempt t start replicatin that was blcked. N actin is required. When the in-prgress cnfiguratin replicatin Jb cmpletes, the next scheduled cnfiguratin replicatin task will begin. SCA0025 NETWORK_ELEMENT_TOO_BUSY(Cde.SCA0025) prtected AlarmData create(string synckey, String extrainf) descriptin = "The target is t busy t respnd t all requests. " + "Cnsider reducing the number f parallel peratins."; Help n this Alarm: This alarm will ccur when the API call t the cluster returns this errr. It indicates the cluster nde is busy and is refusing t answer API calls. This can happen if t many parallel peratins are issued t the cluster using PAPI. N arm will ccur in this cnditin but Eyeglass can nt cmplete the peratin and will generate ther errrs. This can als ccur n a heavily used cluster r a nde in the cluster that has resurce issues i.e. CPU utilizatin. T crrect this peratin raise a supprt request t get instructins t reduce the number f parallel API calls used t cnnect t a cluster. 17

18 SCA0026 DR_DASHBOARD_STATUS_CHANGE_ALARM (Cde.SCA0026) descriptin = "The jb status fr the jb changed t errr"; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm will ccur when there is an errr state either n a Cnfiguratin Replicatin Jb r n a SyncIQ Plicy Jb resulting in an verall DR Dashbard status related t that plicy t be in Errr. T trublesht this errr, lgin t the Eyeglass web page and pen the DR Dashbard windw. Find the Jb which was reprting an errr and expand it t determine whether the issue is with the SyncIQ plicy Jb r the Eyeglass Cnfiguratin Replicatin Jb. If the prblem lies with the SyncIQ Jb, further trubleshting shuld be dne frm OneFS. If the prblem lies with Eyeglass Cnfiguratin Replicatin Jb, pen the Alarms windw and lk fr an alarm which has this Cnfiguratin Replicatin Jb as the surce. The Inf f this alarm will prvide additinal details regarding the cause f the issue. SCA0027 DR_DASHBOARD_STATUS_CHANGE_WARNING (Cde.SCA0027) descriptin = "The jb status fr the jb changed t either 'pending' r 'disabled'"; severity = AlarmSeverity.WARNING; Help n this Alarm: This alarm will ccur when there is a DR Dashbard status change fr a Jb t either Pending r Disabled. 18

19 Fr a status f Pending, n actin is required. This is an indicatin that the Jb has nt yet been run. Fr a status f Disabled, this status may ccur if the SyncIQ Plicy has been disabled in OneFS r if the Cnfiguratin Replicatin Jb has been User Disabled in Eyeglass. If Disabled is nt the crrect status fr this Jb, lgin t the Eyeglass web page and pen the DR Dashbard windw. Expand the Jb related t the alarm t determine whether the SyncIQ Plicy has been disabled r the Eyeglass Cnfiguratin Replicatin Jb. If this Jb shuld nt be disabled fr the SyncIQ plicy yu must enable using the OneFS interface. Fr Eyeglass Cnfiguratin Replicatin, pen the Jbs windw and then select the Jb in the list. Open the Select a bulk actin menu and select Enable/Disable. SCA0028 RUNBOOK_ROBOT_JOB_FAILED(Cde.SCA0028) descriptin = "The Runbk Rbt jb failed fr jb: " Help n this Alarm: This alarm will ccur when the run bk rbt jb fails and indicates yu have miscnfigured the rbt r the rbt failed and yur cluster is nt ready fr a real DR event. The rbt is the best indicatin f readiness fr failver. SCA0029 POLICY_FAILOVER_FAILURE(Cde.SCA0029) descriptin = "Plicy Failver Jb failed."; Help n this Alarm: This alarm will ccur when a DR Assistant failver jb has been created and submitted t failver a plicy. T recver frm this alarm. Open the DR Assistant icn n the Eyeglass desktp and select the failver histry. Review the failver lg fr the failver jb t find which step in the failver did nt cmplete s yu knw where t begin manual step recvery. Use the Failver Recvery Guide fr guidance n manual recvery. 19

20 SCA0030 ACCESS_ZONE_FAILOVER_FAILURE(Cde.SCA0030) descriptin = "Access Zne Failver Jb failed."; Help n this Alarm: This alarm will ccur when a DR Assistant failver jb has been created and submitted t failver an Access zne. T recver frm this alarm. Open the DR Assistant icn n the Eyeglass desktp and select the failver histry. Review the failver lg fr the failver jb t find which step in the failver did nt cmplete s yu knw where t begin manual step recvery. Use the Failver Recvery Guide fr guidance n manual recvery. SCA0031 DFS_FAILOVER_FAILURE(Cde.SCA0031) descriptin = "DFS Failver Jb failed." severity = AlarmSeverity.MAJOR Help n this Alarm: This alarm will ccur when a DR Assistant failver f a DFS jb has failed. The DR Assistant histry windw has a lg that shuld be reviewed fr which step failed and take crrective actin frm when the failure ccured t manually recver the failed steps. Use the Failver Recvery Guide fr guidance n manual recvery.. SCA

21 READINESS_JOB_FAILED(Cde.SCA0032) descriptin = "Readiness jb failed t run." severity = AlarmSeverity.MAJOR Help n this Alarm: The Failver Readiness jb encuntered unexpected errrs when running. Run Failver Readiness manually frm the Eyeglass Jbs windw. Ensure the Access Zne Prerequisites have been meet. SCA0033 READINESS_CHECK_ERRORS(Cde.SCA0033) descriptin = "Readiness jb executin fund errrs - nt ready " + "fr failver."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm will ccur when a Zne readiness jb that check varius parameters, settings, mappings fr Smartcnnect Znes, SPN values n cluster machine accunts are nt registered with the AD. This requires delegatin steps t SPN prperty n the machine accunt and shuld be check first in dcumentatin the prcedures. Netwrk mapping nt cmpleted is anther reasn the readiness jb can fail. It will als be failed if SyncIQ jb assciated with the Zne has failed (based n its path and access zne rt path), if cnfiguratin replicatin als fails fr any plicy in an Access zne this will als trigger a zne readiness failure. G t the Eyeglass DR Dashbard Zne Readiness tab and select the zne name t check the status. Click mapping t verify all hints are in place, then click status make sure its green if nt lk fr the failed item in the list and take actin t reslve either SyncIQ failures, cnfiguratin replicatin jb failures and plicies and SPN failures. SCA

22 SPN_PROCESSING_FAILED(Cde.SCA0034) descriptin = "SPN prcessing (either checking r repairing) has failed."; severity = AlarmSeverity.MAJOR Help n this Alarm: This alarm will ccur when Eyeglass was unable t create r delete SPNs during the regular Inventry task. Manually inspect existing SPNs using the ADSI Edit tl and ensure that there is an SPN fr each Smartcnnect Zne and Smartcnnect Zne alias used fr SMB share access. Make sure delegatin is dne crrectly SCA0035 NODE_COUNT_VIOLATION (Cde.SCA0035) descriptin = "The nde cunt limitatin has been exceeded." severity = AlarmSeverity.CRITICAL Help n this Alarm: This alarm will ccur when yu have an Eyeglass Nde based license (License Type SEL EYEGLASS DR MANAGER ADVANCED OR Ent VAPP in the Eyeglass Managed Licenses windw) and the number f ndes in the Isiln clusters being managed by Eyeglass exceeds the number f ndes that yu have licensed. Additinal nde licenses must be purchased t match the ttal number f managed ndes. N prduct supprt is prvided fr under licensed clusters. SCA0036 RUNBOOK_ROBOT_COUNT_EXCEEDED (Cde.SCA0036) descriptin = "The runbk rbt jb cunt has been exceeded." severity = AlarmSeverity.WARNING Help n this Alarm: This alarm will ccur t infrm yu that yu have cnfigured mre than ne Eyeglass Runbk Rbt jb n the Isiln clusters being managed by Eyeglass. Eyeglass will nly execute ne Runbk Rbt jb. Remve extra Runbk Rbt jbs by deleting the SyncIQ plicies with the special name and ensure nly 1 exists. 22

23 SCA0037 ACCESS_ZONE_FAILOVER_SPN_FAILURE (Cde.SCA0037) descriptin = "Failed t delete r repair SPNs during failver" severity = AlarmSeverity.CRITICAL Help n this Alarm: This alarm will ccur when Eyeglass was unable t create r delete SPNs related t Smartcnnect Zne changes that were made during an Access Zne failver. Manually inspect existing SPNs using the ADSI Edit tl: 1. Failver Surce Cluster - SPN fr SmartCnnect Zne that is prefixed with igls-riginal des NOT exist. 2. Failver Target Cluster - SPN fr SmartCnnect Zne Alias added during failver DOES exist. Where the abve cnditins are nt met, using ADSI Edit t update SPN t be n crrect cluster. Yu cannt create a missing SPN n the Active Cluster if it still exists fr the Failed Over cluster. Yu need t remve frm Failver Over cluster first and then add t active cluster. Make sure delegatin is dne crrectly SCA0038 POLICY_CONTAINS_EXCLUDES (Cde.SCA0038) descriptin = "Fund a plicy with excluded directries. This is nt a supprted SyncIQ cnfiguratin fr failback." severity = AlarmSeverity.WARNING Help n this Alarm: This alarm will ccur t infrm yu that Eyeglass has detected a SyncIQ Plicy with excludes (r includes) cnfigured. This is nt a supprted SyncIQ cnfiguratin fr failback. SCA0039 DISASTER_RECOVERY_TESTING_FAILED(Cde.SCA0039) descriptin = "The disaster recvery testing has failed."; Help n this Alarm: 23

24 This alarm will ccur when Eyeglass has executed DR test mde jb and it resulted in an errr, retry the enable r disable r check the running jbs windw fr details n the failver. SCA0040 FAILOVER_SUCCEEDED(Cde.SCA0040) descriptin = "Failver Succeded"; severity = AlarmSeverity.INFORMATIONAL; Help n this Alarm: This alarm will ccur when Eyeglass has successfully executed any failver mde withut errr and is sent t lg that a failver has ccured. SCA0041 DISASTER_RECOVERY_TEMPLATE_FAILED(Cde.SCA0041) descriptin = "The disaster recvery Template Replicatin has failed."; Help n this Alarm: This alarm will ccur when Eyeglass IsilnSD prduct has deplyed an access zne template t an edge cluster and the jb has failed. Check the running jb fr specific errr r step that failed befre retrying again. SCA0042 DISASTER_RECOVERY_EDGE_REPLICATION_FAILED(Cde.SCA0042) descriptin = "The disaster recvery Replicatin t SD Edge has failed."; Help n this Alarm: This alarm will ccur when Eyeglass IsilnSD editin has executed failver frm the cre t the edge cluster and resulted in failure t setup the edge site after cnfiguring failver. Cnsult the running jbs windw fr specific errr and step befre attempting t retry the jb. 24

25 SCA0043 DISASTER_RECOVERY_EDGE_DEPLOYMENT_FAILED(Cde.SCA0043) descriptin = "The disaster recvery Deplyment t SD Edge has failed."; Help n this Alarm: This alarm will ccur when Eyeglass IsilnSD editin prduct deplys the cre access zne template and syncs shares and exprts t the edge cluster. This setup requires plicies t sync flder structure befre shares and exprts can be created. Check plicy run status n the Isiln and running jbs windw t verify the step and errr cde that blcked the jb frm cmpleting befre retrying the jb. SCA0044 PROBE_UNDER_LICENSED (Cde.SCA0044) descriptin = "The Prbe is under-licensed."; Help n this Alarm: This alarm indicates mre clusters are managed by eyeglass DR than eyeglass CA UIM Prbe license keys installed. Eyeglass will randmly select which clusters are managed fr the CA UIM alarm mnitring. cntact sales@superna.net t get a qute n additinal prbe license keys t remve the alarm and get a fully supprted installatin. SCA0045 INVENTORY_DEGRADED(Cde.SCA0045) descriptin = "Inventry is degraded/incmplete"; severity = AlarmSeverity.MINOR; Help n this Alarm: This alarm indicates the inventry prcess that runs when cluster cnfiguratin replicatin jb runs (default 5 minute intervals), encuntered API failure respnses frm the cluster nde the API request was sent t. This cnditin can clear n its wn if the cluster nde resumes prcessing API REST calls. If the cnfiguratin replicatin jb fails cmpletely then the cluster has stpped answering API calls. It is best t mnitr hw ften this alarm is seen, and IF persistent pen a case with supprt and uplad the lgs t the case. The lgs will be requested if nt attached t the case. If the cnditin persists EMC supprt case shuld be pened, as the nde is verladed and unable t respnd t API queries. NOTE: The OneFS UI als uses the REST API and ignring this event can affect OneFS UI n the nde that is returning the API failures. 25

26 SCA0047 NE_REMOVAL_ERROR(Cde.SCA0047) descriptin = "Netwrk element remval failed"; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm is raised and lgged when a cluster previusly under management has been deleted which is a user actin. This alarm will never be generated withut manual delete frm the Inventry Icn n the eyeglass desktp. If this alarm is unexpected, it indicates smene deleted the cluster and re-added it. This is nt a recmmended prcedure fr any errrs encuntered with eyeglass. Unless yu knw what prcedure yu are ding, check with supprt befre deleting a cluster frm inventry when active DR mnitring in prductin is the current state fr this cluster. Test clusters can be deleted if needed using this prcedure. 1. Open Inventry Windw 2. Select Cluster 3. Right click and select Delete NE SCA0046 CREATE_SD_EDGE_DEPLOYMENT_JOB(Cde.SCA0046) descriptin = "Creatin f SD Edge deplyment Jb failed"; severity = AlarmSeverity.MINOR; Help n this Alarm: This alarm nly applies t the Branch ffice cnfig and data prtectin licensed slutin. when building a new edge site the deplyment jb failed. 1. This can be caused by un-reachable cluster 2. SyncIQ cmmand failed t return with a status cde frm the cluster 3. Timeut waiting n a cluster cmmand t cmplete. Check synciq reprts fr the temprary deplyment plicy that Eyeglass creates t lk fr errrs n the surce cluster where the template access zne was created. 26

27 SCA0049 JOB_AUDIT_WARNING(Cde.SCA0049) descriptin = "Replicatin jb audit resulted in a warning"; severity = AlarmSeverity.WARNING; Help n this Alarm: This alarm is raised when the cluster sync audit step runs as per f cnfiguratin replicatin jb. This step gets inventry frm bth clusters and des a share,exprt,quta, snapsht schedule, dedupe setting, nfs aliases bject and Attribute cmparisn. This generally indicates the surce cluster plicy and target cluster plicy cnfiguratin data is nt 100% in sync. The errr in the alarms windw includes an inf text that will describe the field r bjects that are nt an exact match. Reslutin will require checking with supprt n the errr t determine reslutin. It is pssible that target cluster defaults fr shares,exprts are set in a way that means synced shares r exprts by Eyeglass get mdified by the target cluster t apply cluster defaults that are different frm the surce cluster. This can cause an attribute t change that the audit will detect. The first place t check is default settings n bth clusters match fr shares and exprts. It is als pssible smene manually changed a setting n a share r exprt n the target cluster causing the audit t fail. In general we recmmend that bth surce and target clusters are exact matches. SCA0050 QUOTA_INVENTORY_FAILED(Cde.SCA0050) descriptin = "Failed t retrieve qutas"; severity = AlarmSeverity.CRITICAL; 27

28 Help n this Alarm: The qutas are retrieved with REST api calls pages at a time. On clusters with 1000's r 's f thusands f qutas, this prcess requires many api calls t cmplete t cllect each quta and any ntificatins setup fr each quta (retrieved with separate API calls). If an API call fails while retrieving qutas thrugh this lng running multi query part f the Cnfiguratin Sync jb, this errr can be returned. This culd als happen if eyeglass minimum permissins where nt set crrectly and shuld be checked. SCA0051 DEDUPE_REPLICATION_FAILED(Cde.SCA0051) descriptin = "Deduplicatin replicatin jb failed t run"; Help n this Alarm: As f Eyeglass and later dedupe paths are synced between clusters, cnfiguratin replicatin jbs are respnsible fr syncing dedupe paths and if an API failure t set all the paths n the target cluster ccurs this alarm is raised. This culd be minimum permissins issue with the eyeglass service accunt r API failure and cnfiguratin replicatin in running jbs shuld be expanded t find the inf text that identifies the API errr that triggered the failure. Search dcumentatin site n hw t find and identify sync errrs. SCA0052 DUPLICATE_INVENTORY_ITEM(Cde.SCA0052) descriptin = "Fund duplicate inventry items."; 28

29 Help n this Alarm: This errr is raised when inventry functin that runs as part f cnfiguratin jb, identifies tw entries that are duplicate and cannt be saved t the database. Raise a supprt case if this errr is seen n instructins n hw t reset the database t remve duplicate items. The database in and later can be rediscvered safely with all jb settings being discvered. SCA0053 CONTINUOUS_OPERATION_STATUS_ERROR(Cde.SCA0053) descriptin = "Cntinuus peratin status is ERROR"; Help n this Alarm: The new cntinuus peratins dashbard shws the verall status f Snapsht sync and dedupe sync status, if this dashbard and status can nt be updated frm the cnfiguratin sync jbs r if sync status failed n SyncIQ plicies paths with snapsht schedules r dedupe path settings related t SyncIQ jbs are nt in Sync n surce and target cluster, this alarm is raised indicate Readiness fr peratins n the target cluster is impacted. Review the dashbard t identify the plicy that is affected, which will help identify which area snapshts r dedupe are in sync errr state. This can be dne using the running jbs windw and expanding the last errred jb t find the plicy and sectin fr snapsht schedule and dedupe sync t identify the API errr that is the rt cause f the dashbard state change t errr state. Search dcumentatin site n hw t find and identify sync errrs. SCA0054 MIGRATION_JOB_SUCCEEDED(Cde.SCA0054) 29

30 descriptin = "Migratin jb succeeded."; severity = AlarmSeverity.INFORMATIONAL; Help n this Alarm: This indicates an Access Zne Migratin jb has cmpleted successfully. SCA0055 ARCHIVE_UPLOAD_FAILED(Cde.SCA0055) descriptin = "Archive uplad failed"; severity = AlarmSeverity.CRITICAL; Help n this Alarm: The new abut Eyeglass --> backup tab nw has uplad directly t supprt ptin fr lgs, this errr indicates the uplad failed. Which is likely caused by firewall blcking the Eyeglass appliance frm directly reaching the supprt prtal t uplad the lg. If yu see this errr it means supprt did nt get the lg file and yu shuld lgin t the supprt site dwnlad the backup archive and uplad manually t the supprt site. The direct uplad requires prt 443 HTTPS directly t the Internet frm the Eyeglass appliance. SCA0056 DEDUPE_AUDIT_FAILED(Cde.SCA0056) descriptin = "Deduplicatin audit jb failed t run"; Help n this Alarm: 30

31 This indicates the audit f bth clusters dedupe settings (run autmatically fr the cnfiguratin sync jbs), was nt able t cmplete the cmparisn between the cluster. Run manually again and see if the errr persists. If the errr is still present then pen a case with supprt. SCA0057 QUOTA_SYNCHRONIZATION_FAILED(Cde.SCA0057) descriptin = "Quta Synchrnizatin Jb Failed"; Help n this Alarm: When a quta jb run during failver r manual (shuld nt be run manually). An errr can ccur if the cluster returns a create r delete quta errr. This is mst cmmn when a dmain lck frm a quta scan blcks quta create API's. Unlinked Everyne qutas can als cause quta create r delete t fail. Use the inf text in the running jbs screen t cllect the errr cde and submit a case t Supprt. SCA0058 ERROR_RETRIEVING_CLUSTER_VERSION(Cde.SCA0058) descriptin = "Errr retrieving cluster versin."; Help n this Alarm: This errr ccurs when a heartbeat task checks the cluster Onefs versin and the api fails. This is cmmnly seen when a cluster was upgraded t Onefs 8 but the SCA prcess was nt restarted afterwards. This dcument explains steps needed when a cluster majr versin frm 7 t 8 is cmpleted 31

32 and hw t have Eyeglass detect the new cluster versin. Guide here. RSW0018 RANSOMWARE_DEFENDER_UNDER_LICENSED(Cde. RSW0018) descriptin = "The Ransmware Defender is under-licensed."; Help n this Alarm: This alarm will be raised when Eyeglass has mre licenses and clusters added than Ransmware agent license installed. Each mnitred cluster requires an agent license. Cntact sales@superna.net t get a qute fr agent licenses. SCA0060 ERROR_GENERATING_DATASET(Cde.SCA0060) descriptin = "Errr generating data sets."; severity = AlarmSeverity.MINOR; Help n this Alarm: This alarm is raised when the servicenw integratin api tries t build a data set that is expsed via an xml url ip address/servicenw/servicenw.xml. This errr wuld ccur if nt all API data is available t generate the dataset and expse thrugh the xml interface. This des nt affect DR functinality and can be ignred if yu are nt using this feature. RSW0001 RANSOMWARE_DEFENDER_EVENT(Cde. RSW0001) 32 descriptin = "Ransmware signal received.";

33 severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm is raised fr each security event raised fr a user. This shuld be reviewed in the active events tab f the ransmware defender icn t determine shares affected r lck ut status fr this event. Actins pssible are lckut, recver, initiate self recvery ptin. RSW0002 RANSOMWARE_USER_LOCKED(Cde. RSW0002) descriptin = "Lcked user access."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: A user was lcked ut with a Majr r Critical detectin security event. Cnsult the Ransmware defender GUI t identify the user ID, IP address f the machine where the user was lgged in. Files affected can be exprted t a CSV t inspect and remediate cmprised files. The data recvery initiated ptin can be used t recver files frm DR and snapshts. The user can be restred using the restre user access ptin. RSW0003 RANSOMWARE_USER_LOCK_FAILED(Cde. RSW0003) descriptin = "Failed t lck user access after ransmware events received."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: A lck f a user accunt was nt successful, cnsult the lg fr the actin menu t see which shares r clusters the lckut jb failed. This indicates these shares are nt lcked ut fr this user and manual lckut 33

34 f the share fr the affected user shuld be dne. The lckut is nt retried. It can be retried frm the actins menu. RSW0004 RANSOMWARE_ECA_IGLS_SERVICE_FAILURE(Cde. RSW0004) descriptin = "ECA Service nt frwarding all security events"; Help n this Alarm: One r mre ndes n an ECA cluster are nt successfully cmmunicating with the Eyeglass appliance. Click n the Manage Services icn n the Eyeglass desktp, and use the status f each ECA nde and it's subcmpnents t determine which ECA nde is unhealthy. RSW0005 RANSOMWARE_ECA_HBASE_FAILURE(Cde. RSW0005) descriptin = "ECA Service nt scanning Hbase fr events"; Help n this Alarm: If the alarm in SCA0064 is raised, eyeglass will attempt t peridically scan the ransmware signals database fr new signals. If this scanning cannt happen, this alarm will be raised. T reslve: restre eyeglass t hbase cnnectivity. RSW

35 RANSOMWARE_ECA_COMM_FAILURE(Cde. RSW0006) descriptin = "ECA Service unreachable t scan fr events"; Help n this Alarm: The Eyeglass VM cannt reach the ECA cluster t scan the analytics database. This impacts detectin f Ransmware events. This shuld be fixed and lk at netwrking and ecactl CLI cmmands in ransmware admin guide fr trubleshting. ECA0007 RANSOMWARE_NODE_FAILURE(Cde. ECA0007) descriptin = "ECA Nde inactive r in errr state"; Help n this Alarm: An ECA cluster nde has stpped sending alive heartbeats t the eyeglass VM. The ECA cluster is nw in a degraded state until the nde is fixed. See the admin guide n steps t lgin t the nde and check services and cntainer health. RSW0008 RANSOMWARE_ENTER_MONITOR_MODE(Cde. RSW0008) { descriptin = "Ransmware: Entered mnitr nly mde"; 35

36 Help n this Alarm: When the Eyeglass Ransmware settings has mnitr mde enable n lckut will ccur. This alarm is a reminder that n data prtectin is enabled with mnitr mde. RSW0009 RANSOMWARE_LEAVE_MONITOR_MODE(Cde. RSW0009) descriptin = "Ransmware: Left mnitr nly mde"; Help n this Alarm: When the Eyeglass Ransmware defender setting disables mnitr mde, this alarm indicates that data prtectin mnitring is nw active. RSW0010 RANSOMWARE_ECA_VERSION(Cde. RSW0010) descriptin = "Ransmware: ECA nde versin des nt match the Eyeglass versin."; Help n this Alarm: If the ECA cluster versin des nt match the Eyeglass versin this alarm is raised. The versins shuld match and upgrades shuld be cmpleted t match ECA and Eyeglass versins. RSW0011 RSW_RESTORE_ACCESS_SUCCESS(Cde.RSW0011) 36

37 descriptin = "User access restred."; severity = AlarmSeverity.INFORMATIONAL; Help n this Alarm: The users permissins n the security event were restred fr all shares that had a lckut applied. Check the security event histry t verify the list f shares. RSW0012 RSW_RESTORE_ACCESS_FAILED(Cde.RSW0012) descriptin = "Failed t restre user access."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: The users permissins n the security event were nt all restred. Open the security event histry t review the list f shares that were nt successfully restred and manaully edit the share permissins t remve the deny read permissin fr the user named in the security event. RSW0024 SECURITY_GUARD_FAILURE(Cde. RSW0024) descriptin = "Ransmware: Security Guard Failure"; Help n this Alarm: The security if cnfigured, runs n a schedule and failure shuld checked frm the lgs n the Ransmware defender icn, Security guard tab and pen the last lg t check which step failed. This 37

38 feature tests yur defenses are active and functining as expected. This shuld be crrected and using service manager icn t verify the ECA is reachable and healthy. Check the cluster igls-hney pt share exists. Check ther alarms in the alarms icn t verify the cluster(s) managed by the security guard feature can be reached. Nte SMB pen prt is required frm Eyeglass t the Isiln clusters under management. RSW0013 RSW_SNAPSHOT_WARNING(Cde. RSW0013) descriptin = "Nt all snapshts were created."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm is raised by Ransmware defender when a snapsht create failed n ne r mre shares detected as part f a security event fr a user. The Active security event tab shuld be checked and review the list f shares fr the security event and cmpare t the snapsht list clumn t see which cluster r path des nt have a snapsht created. Als pen jb icn, running jbs tab and find the snapsht create jb and find the cluster and path that failed t create the snapsht. Alternative pen is select security actin menu and run create snapsht t retry the snapsht create again. Pssible reasns fr failure: licensing n Isiln, eyeglass service accunt snapsht create permissin is missing (fix by adding snapsht create permissin t the eyeglass service accunt). RSW0014 RSW_SNAPSHOT_FAILED(Cde. RSW0014) 38 descriptin = "Failed t create snapshts";

39 severity = AlarmSeverity.CRITICAL; Help n this Alarm: See explanatin n alarm SCA0075 n details and steps t attempt anther create f snapsht r debug the issue. RSW0015 RSW_SNAPSHOT_DELETE_WARNING(Cde. RSW0015) descriptin = "Nt all snapshts were deleted"; Help n this Alarm: It indicates a security event snapsht was attempted t be deleted frm the GUI but failed. Snapshts applied n a security event and have an expiry f 48 hurs. If yu want t delete the snapsht sner frm Ransmware defender security event actin menu and it fails with this errr cde. Check eyeglass rle permissins are set crrectly. RSW0016 RSW_SNAPSHOT_DELETE_FAILED(Cde. RSW0016) descriptin = "Failed t delete snapshts"; 39

40 Help n this Alarm: See explanatin fr SCA0077. SCA0061 DISCOVERY_RETRIEVAL_ERROR descriptin = "Failed t retrieve NE data"; Help n this Alarm: This applies t Unity REST API retrieval failure. SCA0062 REST_API_ERROR descriptin = "Failed API REST request"; Help n this Alarm: This applies t Unity REST API retrieval failure. SCA

41 POLICY_FAILOVER_CANCEL(Cde. SCA0063) descriptin = "Plicy Failver Jb canceled."; Help n this Alarm: In release 2.0 and later a failver jb can be canceled. This alarm indicates smene canceled a running failver. The failver lg als indicates the failver was canceled. Nte: all recver steps frm a failed failver are manual. SCA0064 ACCESS_ZONE_FAILOVER_CANCEL(Cde. SCA0064) descriptin = "Access Zne Failver Jb canceled."; Help n this Alarm: In release 2.0 and later a failver jb can be canceled. This alarm indicates smene canceled a running failver. The failver lg als indicates the failver was canceled. Nte: all recver steps frm a failed failver are manual. SCA0065 DFS_FAILOVER_CANCEL(Cde. SCA0065) 41

42 descriptin = "DFS Failver Jb canceled."; Help n this Alarm: In release 2.0 and later a failver jb can be canceled. This alarm indicates smene canceled a running failver. The failver lg als indicates the failver was canceled. Nte: all recver steps frm a failed failver are manual. SCA0066 RUNBOOK_ROBOT_JOB_CANCELED(Cde. SCA0066) descriptin = "The Runbk Rbt jb canceled fr jb: " Help n this Alarm: In release 2.0 and later a failver jb can be canceled. This alarm indicates smene canceled a running failver. The failver lg als indicates the failver was canceled. Nte: all recver steps frm a failed failver are manual. RSW0021 SECURITY_EVENT_FAILED(Cde. RSW0021) descriptin = "Security Event Received but Failed t Prcess"; severity = AlarmSeverity.CRITICAL; Help n this Alarm: 42

43 The Ransmware Defender r Easy Auditr prducts use the ECA cluster t prcess audit events. When a security event is detected a REST message is sent t Eyeglass t prcess the event. This errr indicates Eyeglass received a security event but was nt able t cnnect t the ECA cluster t retrieve specifics abut the event. This is a critical event indicated netwrking r reachability between Eyeglass and ECA cluster. This shuld be debugged immediately as it is pssible that nw security events will be reprted in Eyeglass UI r prcess with autmated respnse actins until crrected. RSW0022 SECURITY_EVENT_RETURNED_ZERO(Cde. RSW0022) descriptin = "Security event received but failed t return affected file list"; Help n this Alarm: This alarm indicates a security event was received and Eyeglass cnnected t the ECA cluster t get a list f files and details abut the security event but n data was returned frm the query. This indicates a cnnectin was successful and a respnse was prcessed frm the ECA cluster. This issue can happen if NTP is nt cnfigured n eyeglass and the ECA cluster ndes r if the time drifts n the ECA cluster cmpared t Eyeglass. Verify NTP and cluster and Eyeglass times are nt drifting. SCA0069 POLICY_POOL_MAPPING_ERROR(Cde. SCA0069) descriptin = "Errr mapping plicy t a pl."; 43

44 Help n this Alarm: This validatin alarm is raised by DR Readiness prcess that verifies that each plicy in an Access zne has been mapped t an IP pl. This alarm will be raised if IP pl cnfiguratin has been started n an access zne and nt cmpleted OR if a new plicy is created fr an access zne and nt yet mapped t a p. Cnsult the Access Zne Design guide n IP pl supprted cnfiguratins. EAU0004 TIME_SKEW_ERROR(Cde. EAU0004) descriptin = "Time skew between Eyeglass Clustered Agent and Eyeglass Appliance is t great."; severity = AlarmSeverity.WARNING; Help n this Alarm: This alarm indicates the time has drifted between the ECA cluster ndes and Eyeglass. Accurate time is required between all the ndes and between eyeglass and the ECA ndes. EAU0003 EVENT_AUDIT_TIME_SKEW_ERROR(Cde. EAU0003) descriptin = "Time skew between last cnsumed and last lgged audit event is t great."; Help n this Alarm: 44

45 This alarm cnditin mnitrs the Isiln ndes last lgged audit events versus the last event prcessed by the ECA cluster. T ensure real-time mnitring and searching current audit data, this gap in time shuld be as lw as pssible. This alarm is raised when the gap is widening between auditing and cnsuming audit events and is in indicatin that cluster resurces CPU shuld be increased t allw audit event prcessing t increase. Audit event ingestin is als limited n ECA clusters and this value can be cnfigured t allw higher event rates t be prcessed. Cntact supprt if yu receive this alarm. EAU0005 NO_SMART_QUOTA_FOR_DLP_PATH(Cde.EAU0005) descriptin = "There is n smart quta fr a path limited by a Data Lss Preventin threat detectr"; Help n this Alarm: The SCA0070 DISK_SPACE_FULL_WARNING(Cde. SCA0070) descriptin = "Disk usage has reached 75%."; severity = AlarmSeverity.WARNING; Help n this Alarm: This alarm is raised when disk space n Eyeglass r ECA ndes exceeds 75% and indicates the lgs are cnsuming mre space than required. The lgs are cnfigured fr circular lgging and shuld nt fill the hard disk space. > 75% may indicate anther prcess cnsuming space r memry dump files. Open a case with supprt if yu get this alarm. 45

46 SCA0071 DISK_SPACE_FULL_ERROR(Cde. SCA0071) descriptin = "Disk usage has reached 90%."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm is raised when disk space n Eyeglass r ECA ndes exceeds 90%. The VM will likely fail sn if nt crrected and will be unable t lg r perfrm nrmal peratins. Open a case immediately with supprt. RSW0017 HBASE_UPGRADE_FAILURE(Cde.RSW0017) descriptin = "HBASE upgrade failed."; severity = AlarmSeverity.INFORMATIONAL; Help n this Alarm: The Database stred n Isiln upgrade failed t cmplete. Cntact supprt. 46

47 RSW0020 BACKUP_INGESTION_FAILURE(Cde.RSW0020) descriptin = "Turbaudit backup ingestin failed."; severity = AlarmSeverity.WARNING; Help n this Alarm: This errr means the histrical event ingestin did nt prcess all files. Please pen a supprt case fr instructins t reslve. ECA0002 ECA_CRITICAL_ERROR(Cde.ECA0002) descriptin = "Eyeglass Clustered Agent unexpected errr."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: The clustered Agent has an errr that requires supprt lgs t investigate. please pen a supprt case. ECA0001 ECA_SERVICE_INFO(Cde.ECA0001) descriptin = "Eyeglass Clustered Agent infrmatin."; 47

48 severity = AlarmSeverity.INFORMATIONAL; Help n this Alarm: ECA0003 ECA_SERVICE_WARNING(Cde.ECA0003) descriptin = "Eyeglass Clustered Agent warning."; severity = AlarmSeverity.WARNING; Help n this Alarm: The Eyeglass clustered agent has a cmpnent in warning state, this can impact peratinal state. Open the managed service icn t identify the warning and the cmpnent name. Open a supprt case and identify the cmpnent name and errr in managed services fr prcedures t reslve. ECA0004 ECA_MINOR_ERROR(Cde.ECA0004) descriptin = "Eyeglass Clustered Agent unexpected minr errr."; severity = AlarmSeverity.MINOR; 48

49 Help n this Alarm: The Eyeglass clustered agent has a cmpnent in minr errred state, this will nt negatively affect peratins. Open the managed service icn t identify the warning and the cmpnent name. Open a supprt case and identify the cmpnent name and errr in managed services fr prcedures t reslve. ECA0005 ECA_MAJOR_ERROR(Cde.ECA0005) descriptin = "Eyeglass Clustered Agent unexpected majr errr."; Help n this Alarm: The Eyeglass clustered agent has a cmpnent in majr errred state, this will negatively affect peratins. Open the managed service icn t identify the warning and the cmpnent name. Open a supprt case and identify the cmpnent name and errr in managed services fr prcedures t reslve. ECA0006 ECA_FATAL_ERROR(Cde.ECA0006) descriptin = "Eyeglass Clustered Agent unexpected fatal errr."; severity = AlarmSeverity.FATAL; Help n this Alarm: 49

50 The Eyeglass clustered agent has a cmpnent in crashed state, this will negatively affect peratins. Open the managed service icn t identify the warning and the cmpnent name. Open a supprt case and identify the cmpnent name and errr in managed services fr prcedures t reslve. EAU0006 AUDITOR_REPORT_SUCCESS(Cde.EAU0006) descriptin = "Easy Auditr Reprt jb succeeded."; severity = AlarmSeverity.INFORMATIONAL; Help n this Alarm: This indicates an audit reprt has be cmpleted by and audit administratr actin in the Easy auditr GUI r a scheduled search has cmpleted. EAU0007 ACTIVE_AUDITOR_EVENT(Cde.EAU0007) descriptin = "Active Auditr event received."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm indicates an autmated security plicy in Easy Auditr has crssed a defined plicy limit and 50

51 raised a security event t be reviewed by a security administratr. ES0001 ES_NODE_COUNT_VIOLATION(Cde.ES0001) descriptin = "Nde cunt limitatin has been exceeded fr the applicatin Eyeglass Search."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: This alarm indicates a license vilatin based n the Isiln nde cunt and the installed license keys fr the Eyeglass Search prduct. This affects yur appliance access t supprt in this state. Please pen a case with supprt fr next steps. EAU0008 ROBO_AUDIT_FAILURE(Cde.EAU0008) descriptin = "Rb Audit Failed."; severity = AlarmSeverity.CRITICAL; Help n this Alarm: The RbAudit schedule health check failed t find all the events created by the RbAudit service accunt. Lgin t Eyeglass, pen Easy Auditr, select RbtAudit n the menu and pen the last lg that indicates failed. Dwnlad the lg and pen a supprt case and attach the lg and A full supprt backup t have supprt review yur envirnment. DRSDEDGE0001 DRSDEDGE_NODE_COUNT_VIOLATION(Cde.DRSDEDGE0001) 51