ONTAP Discussions

Syslog Interface for cluster log-forwarding

ConfusedParrotfish
547 Views

Hi,

 

all my clusters are sending their syslogs via their node_mgmt interfaces, except for one. In this one (2-node cluster) one node sends via node_mgmt and the other via cluster_mgmt.

Because of how my company validates the syslog sources, I need all my syslogs to come from the node_mgmt interfaces, but there's no way to force it to. 

Why is one cluster behaving like this? When I migrate the cluster_mgmt-interface to the other node, this node stops sending through the node_mgmt and cluster_mgmt takes over.

I'm confused.

 

Cheers,

ConfusedParrotfish

4 REPLIES 4

Sanaman
446 Views

Please check the service list of the node management interface if it is allowed for "management-log-forwarding".

 

 

network interface show -vserver <cluster> -lif <node_managemnt_lif> -inst

Vserver Name: cluster_name
Logical Interface Name: <node(a/b)_management_lif>
Service Policy: default-management
Service List: management-core,
management-autosupport,
management-ssh, management-https,
management-ems,
management-ntp-client,
management-dns-client,
management-ad-client,
management-ldap-client,
management-nis-client,
management-http,
backup-ndmp-control,
management-snmp-server,
management-ntp-server,
management-log-forwarding

 

If it is not there (allowed services), you can add it.

ConfusedParrotfish
437 Views

Node- and Cluster-mgmt interfaces have the management-log-forwarding service configured. I can probably remove the service from the cluster_mgmt to prevent it from sending syslogs. 

ConfusedParrotfish
406 Views

I just looked at all the other clusters and they all have the management-log-forwarding service configured on node and cluster mgmt. I'm still confused why only one cluster behaves like that.

Sanaman
363 Views

So both node management and cluster management using the same "service-policy" across all the clusters. Also, your node management and cluster management on same network. No specific routes exists. Right?

Public