As it turns out, it was sending everything to the syslog server as expected, but someone had set a filter up to capture everything that came from the subnet that the SE host was in.  I took care of the filter and we're seeing everything that we were looking for.
I'm working with a customer that has a VMAX20k that they administer via Unisphere for VMAX. They require that all events be logged to a syslog server. I've followed the tech article on setting up storevntd and have ensured that they have all alerts set to notify for their array. The problem is, the logging only appears to occur into the local file, not the syslog server. The syslog server has actually caught a few errors and a warning, but nothing other than that. Below is the storevntd configuration portion of the config file:  ############################################################################### ### storevntd [Event Daemon] notes ### ###     This daemon acts as the clearing house for Solutions Enabler events ###     on a host. ###     Refer to the storevntd(3) man page for additional details. ############################################################################### # # Parameter:            SYMM_POLL_INTERVAL # # Allowed values:       A number of seconds. # # Default value:        60 # # Description:          Specifies how often, in seconds, to poll Symmetrix  #                       arrays for events that need to be delivered. # # storevntd:SYMM_POLL_INTERVAL = 300 #------------------------------------------------------------------------------ # # Parameter:            EVENT_LISTEN_PORT # # Allowed values:       An IP port number. # # Default value:        0 - means to let the OS pick an unused port #  # Description:          Which IP port to use when listening for events being #                       forwarded from remote hosts. By default, an unused #                       port picked by the OS is used. This option might #                       be needed if the presence of a firewall requires #                       the use of a particular port. # # storevntd:EVENT_LISTEN_PORT = 2222 #------------------------------------------------------------------------------ # # Parameter:            LOG_EVENT_TARGETS #                                    # Allowed values:       One or more (space separated) of: snmp, file, system,  #                       syslog # # Default value:        none # # Description:          Controls whether events should be automatically logged. #                       One or more of the following may be supplied: #                       file: Events are written to a file on disk. #                       snmp: Events are mapped into SNMP traps. #                       system: Events are written to the Event Log (Windows)  #                               or the local syslog service (otherwise). #                       syslog: Events are sent directly to a remote syslog #                               server, bypassing any local syslog service. # #                       Some of these possible targets can be configured by #                       options that are described below. # storevntd:LOG_EVENT_TARGETS = syslog file #------------------------------------------------------------------------------ # # Parameter:            LOG_SYMMETRIX_EVENTS # # Allowed values:       see above # # Default value:        No events are logged. # # Description:          Specifies events that are to be automatically logged. #                       Refer to the LOG_EVENT_TARGETS option above. #                       This option consists of a records separated by a  #                       semicolon. Typically, each record will be placed on a  #                       line by itself. Each of these records in turn consists  #                       of a number of comma-separated fields. # #                       [sid=nnnnn,] CAT[, ...] [,ignore] [,tgt=xxx] # #                       sid=nnnnnnnnnnnn #                       Specifies a Symmetrix ID. By default, all known #                       Symmetrix arrays will be monitored. #                        #                       CAT           #                       Specifies the event(s) to be monitored. This can #                       be either the name of an event category or a #                       numerical event ID. This is the only field that is #                       required. One or more values (comma separated) #                       may be present. # #                       Supported categories are: #                       status #                       events #                       array subsystem #                       checksum #                       diagnostic #                       environmental #                       device pool #                       service processor #                       srdf system #                       srdf link #                       srdfa session #                       srdf consistency group #                       director #                       device #                       disk # #                       comp=xxxx #                       "comp=aaa,bbb,ccc" #                       Certain events apply to specific sub-components #                       within the array: a device (4 digit hexadecimal), #                       disk, pool. This field specifies that only #                       events for the specified component (or components) #                       should be delivered. If more than one component #                       is being present, the entire field must be enclosed #                       in double quotes. e.g., "comp=0004,0010,0100" # #                       thresh_critical=nn #                       thresh_major=nn (equivalent to:  thresh=nn) #                       thresh_warn=nn #                       thresh_info=nn #                       Certain events correspond to numerical quantities #                       of some sort. A threshold is associated with #                       each severity level, and an event is generated #                       at that severity when the event's value exceeds #                       the associated threshold. These fields can be #                       used to override the default threshold values #                       controlling when an event is delivered. # #                       One example of this is the event that indicates the  #                       percentage of space used for a pool. These fields #                       can be set to control when events are to be generated. #                       e.g.: thresh_critical=96, thresh_major=80,  #                       thresh_warn=60 #  #                       ignore #                       If present, these event(s) are not to be logged,  #                       even if they are matched by a different record. #                       tgt=xxx #                       If present, these event(s) are sent to only the #                       specified target, which must be one of: #                       snmp, file, system, syslog. #                       The specified target must also be present in the #                       default target list given by the LOG_EVENT_TARGETS #                       option. # storevntd:LOG_SYMMETRIX_EVENTS = sid=000192605836, audit, disk, device, status, events, array subsystem, checksum, diagnostic, environmental, device pool, service processor, director, device, disk ; #                       sid=222222222222, device pool [IMAGE] #                       sid=333333333333, device, "comp=0101,0102,0104" [IMAGE] #                       array subsystem , tgt=file #------------------------------------------------------------------------------ # # Parameter:            LOG_EVENT_FILE_NAME # # Allowed values:       file name, without any suffix # # Default value:        events # # Description:          For event logging to a file (LOG_EVENT_TARGETS  #                       contains 'file'): the base name of the file that is  #                       used. This file is created within the standard log  #                       file directory. #                       UNIX:     /var/symapi/log #                       Windows:  c:\\Program Files\\EMC\\SYMAPI\\log #                       Depending on the setting of the LOG_EVENT_FILE_TYPE  #                       option, a suffix will added to this name. # storevntd:LOG_EVENT_FILE_NAME = VMAX5836syslog #------------------------------------------------------------------------------ # # Parameter:            LOG_EVENT_FILE_TYPE # # Allowed values:       dated | wrap  # # Default value:         wrap # # Description:          For event logging to a file  #                       (LOG_EVENT_TARGETS contains 'file'): #                       the type of log file that is used.   #                       Two styles are supported: # #                       wrap: Two log files are maintained: ????.log0 and #                       and ????.log1. Logging alternates between #                       these--switching to the other file each time #                       the maximum size specified by the LOG_EVENT_FILE_SIZE #                       parameter is reached. The modified time on the #                       files can be used to determine the "current" one. # #                       dated: A separate log file is used for each day: #                       ????-YYYYMMDD.log. (e.g., events-200411) #                       There are no limits on how large these files #                       can become. # storevntd:LOG_EVENT_FILE_TYPE = dated #------------------------------------------------------------------------------ # # Parameter:            LOG_EVENT_FILE_SIZE # # Allowed values:       A number, in KB  # # Default value:        1000 (1000-KB) # # Description:          Specifies how large each log file is allowed to grow #                       before wrapping to the alternate file. #                       This option is for event logging to a file  #                       (LOG_EVENT_TARGETS contains 'file'):  #                       if LOG_EVENT_FILE_TYPE == wrap. # # storevntd:LOG_EVENT_FILE_SIZE = 5000 #------------------------------------------------------------------------------ # # Parameter:            LOG_EVENT_FILE_RETENTION # # Allowed values:       A number of days, greater than zero. # # Default value:        3 (days) # # Description:          Indicates that log files more than this many days old #                       will be automatically deleted. #                       This option is for event logging to a file  #                       (LOG_EVENT_TARGETS contains 'file'):  #                       if LOG_EVENT_FILE_TYPE == dated.  # # storevntd:LOG_EVENT_FILE_RETENTION = 5 #------------------------------------------------------------------------------ # # Parameter:            LOG_EVENT_FILE_PERMS # # Allowed values:       n | rw | r # # Default value:        r # # Description:          Specifies the permissions to be applied to  #                       new log files that are created.  #                       This option is for event logging to a file   #                       (LOG_EVENT_TARGETS contains 'file'). Possible values:   # #                       rw: Anyone can read or write. #                        r: The owner (root) can read/write, others can read. #                        n: The owner can read/write, no one else can access. # # storevntd:LOG_EVENT_FILE_PERMS = r #------------------------------------------------------------------------------ # # Parameter:            LOG_EVENT_SYSLOG_HOST #  # Allowed values:       A host name or IP address. # # Default value:        None - a value is required. # # Description:          Specifies the host on which the remote syslog server  #                       is running. This option is for event logging to syslog #                       (LOG_EVENT_TARGETS contains 'syslog'). # storevntd:LOG_EVENT_SYSLOG_HOST = x.x.x.x <== X'd out for obvious reasons, it's a valid syslog server and the port is 514 #------------------------------------------------------------------------------ # # Parameter:            LOG_EVENT_SYSLOG_PORT # # Allowed values:       A decimal port number. # # Default value:        514 # # Description:          Specifies the port to which the remote syslog  #                       server is listening. This option is for event logging  #                       to syslog (LOG_EVENT_TARGETS contains 'syslog'). #                        # # storevntd:LOG_EVENT_SYSLOG_PORT = 514 #------------------------------------------------------------------------------ # # Parameter:            SNMP_TRAP_CLIENT_REGISTRATION # # Allowed values:       IP,port,filter,state - with no spaces # # Default value:        none # # Description:          Provides a list of target IPs and ports to send #                       SNMP traps to, when the LOG_EVENT_TARGETS option #                       specifies snmp. # #                       Format is: IP,port,filter,state, where filter #                       represents the trap sending filtering levels #                       as defined in the fcmgmt MIB, and state #                       represents the start up row state in the  #                       trap_client_registration table in the fcmgmt MIB. # #                       Multiple entries should be on their own line, #                       delineated with a backslash (\) character #                       on the preceding line.  # #                       This parameter can be changed and reloaded   #                       while the event daemon is running, with the #                       CLI stordaemon action storevntd -cmd reload. # # storevntd:SNMP_TRAP_CLIENT_REGISTRATION =  11.22.33.44,162,10,ACTIVE \ #                                            55.66.77.88,162,10,ACTIVE  #------------------------------------------------------------------------------ # # Parameter:            SNMP_MANAGEMENT_URL # # Allowed values:       <:port>  # # Default value:        none # # Description:          Provides launch capability of a management application, #                       such as SMC or ECC, from within a third party #                       management framework.  # #                       This parameter can be changed and reloaded   #                       while the event daemon is running, with the #                       CLI stordaemon action storevntd -cmd reload. # # storevntd:SNMP_MANAGEMENT_URL=local:7070 # ###############################################################################
Storevntd not sending everything to syslog server, help!