topic Re: Forwarding logs to another dervice in ONTAP Discussions

Forwarding logs to another dervice

SVHO — Wed, 04 Jun 2025 11:03:51 GMT

We want to send logs to another device. Per instructions on the link below, which interface would the logs be sent out from. We have 2 controllers (FAS2650). I am guessing its the cluster management interface. Please confirm.

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-sag%2FGUID-9F8EB0DF-12F5-4DA9-B14B-34487DE3717D.html

cluster1::> cluster log-forwarding create -destination 192.168.123.96 -port 514 -facility user

cluster1::> cluster log-forwarding create -destination 192.168.123.98 -port 514 -protocol tcp-encrypted -facility user

Also, what kind of events would it send? Would it be just CIFS access related events?

Thanks,

Re: Forwarding logs to another dervice

hmoubara — Thu, 25 Jun 2020 00:57:50 GMT

Hello,

The logs are transferred either via the node management lif or the cluster management lif. This command is intended for the audit logs to be transferred to a remote server.

Thanks

Re: Forwarding logs to another dervice

SVHO — Thu, 25 Jun 2020 03:26:28 GMT

So the actual IP address (source) would be from where the command was initialized?

Thanks again.

Re: Forwarding logs to another dervice

hmoubara — Thu, 25 Jun 2020 03:41:02 GMT

Correct

Re: Forwarding logs to another dervice

SVHO — Thu, 25 Jun 2020 16:38:45 GMT

Forgot where I read an article saying by default ONTAP does not turn the audit logs on since it takes up resources (probably disk space). So if we were to turn "ON" the forwarding of the logs, would it just forward the logs only or does it generates the logs locally on the system as well?

I believe this is the article I need review for the actual setup.

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-976B35AF-844A-4A8E-95F6-60EC45EEFD58.html

Thanks,