Solved: Re: Event log show command

not_a_Lone_wolf · ‎2020-09-03

Hi Team,

Has anybody used the below set of commands in Cluster shell as per kb: https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/How_to_efficiently_search_the_event_log_in_clustered_Data_ONTAP ?

Events since a specific time
cm6080-rtp2::> event log show -time >=5/2/2014 08:00:00

Events in a specific time range:
cm6080-rtp2::> event log show -time "05/02/2014 08:00:00".."05/02/2014 09:00:00"

I tried to retrive alerts that occured 2 months back, but the result displayed only for last 2 days. Changed to advanced mode as well, but did not work. Does it work in any situation?

maffo · ‎2020-09-03

hi @not_a_Lone_wolf

ONTAP will not keep an infinite amount of system logs; since there is a size limit to it, a system which is logging a lot of events will be able to show a shorter time frame of them.
For now, if you need to access logs of a specific day, you can check Autosupports in Active IQ; for future use you might want to look at a remote syslog server to forward ONTAP events to.

View solution in original post

maffo · ‎2020-09-03

hi @not_a_Lone_wolf

ONTAP will not keep an infinite amount of system logs; since there is a size limit to it, a system which is logging a lot of events will be able to show a shorter time frame of them.
For now, if you need to access logs of a specific day, you can check Autosupports in Active IQ; for future use you might want to look at a remote syslog server to forward ONTAP events to.