A.05.70 HP Insight Remote Support Advanced and Remote Device Access Security Overview (October 2011, 5900-1735)

to solicit an ICMP echo replies from the devices. UDN events are sent to HP via an SSL/TLS connection
(HTTPS over TCP 443). Email notifications can be sent locally using SMTP on TCP 25.
• StorageWorks P4000 Centralized Management Console (CMC)
The CMC application is used to configure individual P4000 storage nodes, as well as for creating
volumes, snapshots, remote copies, and storage clusters of multiple P4000 storage nodes. CMC is used
to configure SNMP settings on the P4000 nodes to allow Insight Remote Support to monitor and collect
system logs on the P4000 nodes in cases of system faults.
2.11.3 Data Collection
WEBES collects the following types of information from endpoint devices:
• Binary Event Log Data
The System Event Analyzer component of WEBES monitors binary event logs. These events are collected
by the Event Log Monitoring Collector (ELMC) client that is installed on the end point device. A persistent
connection is established from WEBES on the CMS to ELMC on the managed device and events are
sent across a socket connection as they are detected.
• EVA Command View Data
The System Event Analyzer (SEA) component of WEBES requires detailed configuration information
about Enterprise Virtual Array (EVA) devices. This information is obtained using the Command View
EVA software running on the storage management server. SEA uses an ELMC connection to the node
to get access to this information. The information may be collected at any time, and is not always related
to the processing of an event, for example, comparing configuration states during analysis. This data
includes various EVA components: storage cell, disks, controllers, disk groups, folder, container, cabinet,
controller shelf, disk shelf, host, virtual disk, and DRM group. In addition, information about the error
counts on fiber ports is collected.
• WBEM Indications
The System Event Analyzer (SEA) component of WEBES is used to monitor WBEM indications from end
point devices. SEA connects to the end point device using the CIM over XML WBEM protocol in order
to set up subscriptions to indications. Once the subscription is made the connection is closed.
When an indication is detected by the CI-MOM, it makes an HTTPS connection back to the WEBES
web interface on TCP port 7906 to deliver the indication. As part of the analysis of the indication, SEA
may make a connection back to the CI-MOM to collect configuration information (a WBEM “get”) as
discussed below.
• Configuration Information
As part of analysis of an event, additional configuration information may be needed to isolate the
location of the fault, or to provide information to HP about the Field Replaceable Unit (FRU) that needs
to be replaced. In these cases, WEBES will make a connection back to the end point device using the
protocols described above.
This information is generally related to the location of FRUs in the device, as well as serial and part
numbers. Note that this is not an inclusive list of the types of information collected.
For Alpha machines the FRU Configuration Tree (FCT) entries are stored in the event log files. This
information describes all of the components in the machine along with part numbers and serial numbers.
For Integrity machines the information provided in the IPMI log is collected. This information is very
similar in content to the information in the FCT. WBEM and SNMP gets are used to get information
about the configuration of a device. In addition, a set of identifying information called CSID data is
collected for each managed device and sent to HP so that we can insure that incoming data and
indications can be traced to a particular device.
2.11 Remote Device Monitoring 31