NetApp ONTAP EMS

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/storage-netapp-ontap-ems/generator.yml \
  --id ontap \
  --live-mode true

Event Types

Realism Features

• About 1,100 records a day in time order, UTC with one-second precision. About 1,070 are ZAPI Snapshot copies of 48 volumes, evenly around the clock, each volume in proportion to its snapshot_weight: on average every 15 minutes to 2 hours for database, log and virtual machine volumes, about every 4 hours for file shares, daily for archives and boot volumes.
• Five administrators fail 7-10 logins a day on a working-day curve (07:00-18:00 UTC full rate, 18:00-22:00 about 40%, night about 15%): a session holds one to four failures a few seconds apart (median 7 s), the first three administrators are the busiest, each mostly uses one application (ssh, or http for System Manager), and nine logins in ten reach the first node. Three service accounts fail 5-9 times a day around the clock in retry loops of one to six failures about 40 s apart, over ontapi or http.
• An account that reaches lockout_attempts consecutive failures is locked one to three seconds after the last one (1.5-3 lockouts a day) and makes no attempt until an unlock that EMS does not log (median two hours). A successful login, also not logged, resets the counter; after a session that gives up, the counter stays until the account's next successful login about an hour later.
• Anti-ransomware protection is paused on a volume about 5-6 times a day and turned back on after a median of about 50 minutes (5 minutes to several hours). The three bulk-data volumes vol_backup_stage, vol_ci_cache and vol_scans are paused one to two times a day each, more often than in a typical cluster; other volumes rarely. A few volumes start in dry-run mode and switch to enabled within the first days. Volume and Vserver UUIDs stay stable within one output.
• Every chain step is ordinary activity in both modes: every administrator fails logins, accounts are locked out every day, several accounts fail within minutes of each other, and the same volumes have protection paused and turned back on. Only the complete ordered chain is kept out: an ordinary pause that would complete it does not happen. A day with an episode has about one more lockout, four to five more failed logins and about half a pause more than a day without.
• No captured ONTAP syslog line was available: event.original follows the documented legacy-netapp grammar (RFC 3164 timestamp, hostname only) and the 9.12.1 catalog message templates, with catalog parameter names in netapp.ems.parameters; RFC 5424 output is not emitted. The severity token is lower case although its case is undocumented, facility user (1) is a scenario choice, and the ECS mapping is inferred with no Elastic integration to follow. Successful logins, unlocks, failures on a locked account and other EMS events (hardware, WAFL, SnapMirror) are not produced. Snapshot names, rates and hold durations are assumptions; there is no weekly cycle and working hours are fixed in UTC. KUMA 4.2 normalization is untested.

Sample Output

{
  "@timestamp": "2026-09-01T11:08:56+00:00",
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "action": "arw.volume.state",
    "category": [
      "configuration"
    ],
    "kind": "event",
    "original": "\u003c13\u003eSep  1 11:08:56 [cluster1-01:arw.volume.state:notice]: Anti-ransomware state was changed to \"disabled\" on volume \"vol_ci_cache\" (UUID: \"5c18ce97-b4b6-4f41-bbb2-4d30c695d6dd\") in Vserver \"svm_nfs01\" (UUID: \"84e08f81-2502-4a44-bd5d-da6a31aec8fc\").",
    "outcome": "success",
    "type": [
      "change"
    ]
  },
  "host": {
    "name": "cluster1-01"
  },
  "log": {
    "syslog": {
      "facility": {
        "code": 1,
        "name": "user"
      },
      "priority": 13,
      "severity": {
        "code": 5,
        "name": "notice"
      }
    }
  },
  "netapp": {
    "ems": {
      "message": "Anti-ransomware state was changed to \"disabled\" on volume \"vol_ci_cache\" (UUID: \"5c18ce97-b4b6-4f41-bbb2-4d30c695d6dd\") in Vserver \"svm_nfs01\" (UUID: \"84e08f81-2502-4a44-bd5d-da6a31aec8fc\").",
      "name": "arw.volume.state",
      "parameters": {
        "op": "disabled",
        "volumeName": "vol_ci_cache",
        "volumeUuid": "5c18ce97-b4b6-4f41-bbb2-4d30c695d6dd",
        "vserverName": "svm_nfs01",
        "vserverUuid": "84e08f81-2502-4a44-bd5d-da6a31aec8fc"
      },
      "severity": "notice"
    }
  }
}

Parameters