topic Re: Syslog forwarding - which LIF is the source in ONTAP Discussions

Syslog forwarding - which LIF is the source

kombayn — Thu, 14 Mar 2024 10:51:26 GMT

Hello

I'm troubleshooting connectivity to syslog server and I can still see:

EMS::SYSLOG_HANDLER: Cannot send an ems message to syslog destination: x.x.x.x Reason: cannot add the destination to the syslog_client. Error: Failed to connect: Operation timed out

Ping to syslog destination is working. Firewall is opened between cluster_mgmt LIF and syslog destination, so it leads me to confirm if really a cluster_mgmt is the source LIF that sends the logs or maybe node management LIFs are sending the logs - can anyone confirm? I've tried to find this information in documentation but I couldn't.

Re: Syslog forwarding - which LIF is the source

Ontapforrum — Tue, 19 Mar 2024 23:16:21 GMT

It uses Node Management interface (for ASUP, time-sync, SNMP, SYSLOG)

Check the ROUTE. Ensure Node_mgmt LIF can reach to Syslog via the configured route.

This KB might help:
https://kb.netapp.com/onprem/ontap/os/Events_not_sent_to_syslog_server_due_to_network_routes

Re: Syslog forwarding - which LIF is the source

chenguanghui — Thu, 10 Apr 2025 07:22:40 GMT

hello:

A TCP/TLS connection has been attempted, but the system log server has not received any response for a long time. There may be an incorrect route configuration or the firewall may be dropping the traffic without sending any response.
1. Check if the FQDN or IP address you entered for the system log server is correct.
2. For each listed node, please check the grid network subnet list, management network subnet list, and client network gateway. Confirm that these ports are configured to route traffic to the system log server through the network interface and gateway (grid, management, or client) that the system log server will access.
3. Confirm that the firewall is not blocking IP and port access to the system log server for TCP/TLS connections from the listed nodes.