ONTAP Discussions

Forward Event Logs on non-Standard Port




Have a FAS2620 running ONTAP 9.3. We need to send the Event logs to a location using a non-standard port, 5514 vice 514. Can that be done? The command syntax does not look like it does.




Re: Forward Event Logs on non-Standard Port


I'm not sure what version of OnTap you are using but yes you can in OnTap 9.  Here is the man page for OnTap 9.3.


cluster log-forwarding create

Create a log forwarding destination

Availability: This command is available to cluster administrators at the admin privilege level.


The cluster log-forwarding create command creates log forwarding destinations for remote logging.


-destination <Remote InetAddress> - Destination Host
Host name or IPv4 or IPv6 address of the server to forward the logs to.
[-port <integer>] - Destination Port
The port that the destination server listen on.
[-protocol {udp-unencrypted|tcp-unencrypted|tcp-encrypted}] - Log Forwarding Protocol
The protocols are used for sending messages to the destination. The protocols can be one of the following values:
  • udp-unencrypted - User Datagram Protocol with no security
  • tcp-unencrypted - Transmission Control Protocol with no security
  • tcp-encrypted - Transmission Control Protocol with Transport Layer Security (TLS)
[-verify-server {true|false}] - Verify Destination Server Identity
When this parameter is set to true, the identity of the log forwarding destination is verified by validating its certificate. The value can be set to true only when the tcp-encrypted value is selected in the protocol field. When this value is true the remote server might be validated by OCSP. The OCSP validation for cluster logs is controlled with the security config ocsp enable -app audit_log and security config ocsp disable -app audit_log.
[-facility <Syslog Facility>] - Syslog Facility
The syslog facility to use for the forwarded logs.
[-force [true]] - Skip the Connectivity Test
Normally, the cluster log-forwarding create command checks that the destination is reachable via an ICMP ping, and fails if it is not reachable. Setting this value to true bypasses the ping check so that the destination can be configured when it is unreachable.


This example causes audit logs to be forwarded to a server at address, port 514 with USER facility.
cluster1::> cluster log-forwarding create -destination -port 514 -facility user


View solution in original post

Re: Forward Event Logs on non-Standard Port


Thanks nboggs, sorry for the delay. I did the cluster xxx commands and logging is set.

I was using the event destination xxx commands. That was what was talked about in a NetApp course I am taking. I am getting entries to our log server now with the cluster xxx commands.



Earn Rewards for Your Review!
GPI Review Banner
All Community Forums