The vserver vscan show-events command displays contents of the event log, which is generated by the cluster to capture important events. If you do not specify any parameters, the command displays the following information for all Vscan servers:

Vserver name
Node name
Vscan server
Event type
Event time

You can specify the -fields parameter to specify which fields of information to display. In addition to the fields above, you can display the following fields:

File path
Vscan server vendor
Vscan server version
Disconnect reason
Scan engine status code
Vserver LIF used for connection
Consecutive occurrence count

Parameters

{ [-fields <fieldname>,…]: If you specify the -fields <fieldname>, … parameter, the command output also includes the specified field or fields. You can use '-fields ?' to display the fields to specify.
| [-instance ] }: If you specify the -instance parameter, the command displays detailed information about all fields.
[-node {<nodename>|local}] - Node: If you specify this parameter, the command displays information only about the events that have occurred on the specified node.
[-vserver <vserver name>] - Vserver: If you specify this parameter, the command displays information only about the events that have occurred for the specified Vserver.
[-event-time <MM/DD/YYYY HH:MM:SS>] - Event Log Time: If you specify this parameter, the command displays information only about the events that have occurred at the specified time.
[-server <IP Address>] - Server: If you specify this parameter, the command displays information only about the events that have occurred for the specified server.
[-event-type <event-type>] - Event Type: If you specify this parameter, the command displays information only about the events that are of the specified event type.
[-file-path <text>] - File Path: If you specify this parameter, the command displays information only about the events that have the specified file path.
[-vendor <text>] - Vscanner Vendor: If you specify this parameter, the command displays information only about the events that have the specified scan-engine vendor.
[-version <text>] - Vscanner Version: If you specify this parameter, the command displays information only about the events that have the specified scan-engine version.
[-disconnect-reason <reason>] - Server Disconnect Reason: If you specify this parameter, the command displays information only about the events that have the specified reason of the server disconnection.
[-lif <IP Address>] - Vserver LIF Used for Connection: If you specify this parameter, the command displays information only about the events that have the specified IP address, which is used for connecting clustered Data ONTAP with the Vscan server.

Examples

The following example displays all the events captured in the cluster:

cluster1::*> vserver vscan show-events

Vserver     Node            Server          Event Type        Event Time
----------- --------------- --------------- ----------------- -----------------
vs1         Cluster-01      192.168.1.1     file-infected     9/5/2014 11:37:38
vs1         Cluster-01      192.168.1.1     scanner-updated   9/5/2014 11:37:08
vs1         Cluster-01      192.168.1.1     scanner-connected 9/5/2014 11:34:55
3 entries were displayed.

The following example displays detailed event information about all the infected files:

cluster1::*> vserver vscan show-events -event-type file-infected -instance
Node: Cluster-01
                        Vserver: vs1
                 Event Log Time: 9/5/2014 11:37:38
                         Server: 192.168.1.1
                     Event Type: file-infected
                      File Path: \\1
                Vscanner Vendor: mighty master anti-evil scanner
               Vscanner Version: 1.0
       Server Disconnect Reason: -
Vserver LIF Used for Connection: 192.168.41.231