topic Syslog Interface for cluster log-forwarding in ONTAP Discussions

Syslog Interface for cluster log-forwarding

ConfusedParrotfish — Mon, 26 Aug 2024 07:19:45 GMT

Hi,

all my clusters are sending their syslogs via their node_mgmt interfaces, except for one. In this one (2-node cluster) one node sends via node_mgmt and the other via cluster_mgmt.

Because of how my company validates the syslog sources, I need all my syslogs to come from the node_mgmt interfaces, but there's no way to force it to.

Why is one cluster behaving like this? When I migrate the cluster_mgmt-interface to the other node, this node stops sending through the node_mgmt and cluster_mgmt takes over.

I'm confused.

Cheers,

ConfusedParrotfish

Re: Syslog Interface for cluster log-forwarding

Sanaman — Tue, 27 Aug 2024 06:14:41 GMT

Please check the service list of the node management interface if it is allowed for "management-log-forwarding".

network interface show -vserver <cluster> -lif <node_managemnt_lif> -inst

Vserver Name: cluster_name
Logical Interface Name: <node(a/b)_management_lif>
Service Policy: default-management
Service List: management-core,
management-autosupport,
management-ssh, management-https,
management-ems,
management-ntp-client,
management-dns-client,
management-ad-client,
management-ldap-client,
management-nis-client,
management-http,
backup-ndmp-control,
management-snmp-server,
management-ntp-server,
management-log-forwarding

If it is not there (allowed services), you can add it.

Re: Syslog Interface for cluster log-forwarding

ConfusedParrotfish — Tue, 27 Aug 2024 07:36:24 GMT

Node- and Cluster-mgmt interfaces have the management-log-forwarding service configured. I can probably remove the service from the cluster_mgmt to prevent it from sending syslogs.

Re: Syslog Interface for cluster log-forwarding

ConfusedParrotfish — Tue, 27 Aug 2024 09:34:52 GMT

I just looked at all the other clusters and they all have the management-log-forwarding service configured on node and cluster mgmt. I'm still confused why only one cluster behaves like that.

Re: Syslog Interface for cluster log-forwarding

Sanaman — Wed, 28 Aug 2024 00:32:51 GMT

So both node management and cluster management using the same "service-policy" across all the clusters. Also, your node management and cluster management on same network. No specific routes exists. Right?

Re: Syslog Interface for cluster log-forwarding

JMN227 — Wed, 11 Dec 2024 15:44:34 GMT

Have you figured this out? I have the same issue and haven't been able to find the answer.

Re: Syslog Interface for cluster log-forwarding

Sanaman — Wed, 11 Dec 2024 22:20:43 GMT

Mine worked after removing the cluster interfaces from management-log-forwarding.