Syslog Interface for cluster log-forwarding

[ConfusedParrotfish]

Hi,

all my clusters are sending their syslogs via their node_mgmt interfaces, except for one. In this one (2-node cluster) one node sends via node_mgmt and the other via cluster_mgmt.

Because of how my company validates the syslog sources, I need all my syslogs to come from the node_mgmt interfaces, but there's no way to force it to. 

Why is one cluster behaving like this? When I migrate the cluster_mgmt-interface to the other node, this node stops sending through the node_mgmt and cluster_mgmt takes over.

I'm confused.

Cheers,

ConfusedParrotfish

[Sanaman]

Please check the service list of the node management interface if it is allowed for "management-log-forwarding".

network interface show -vserver <cluster> -lif <node_managemnt_lif> -inst

Vserver Name: cluster_name
Logical Interface Name: <node(a/b)_management_lif>
Service Policy: default-management
Service List: management-core,
management-autosupport,
management-ssh, management-https,
management-ems,
management-ntp-client,
management-dns-client,
management-ad-client,
management-ldap-client,
management-nis-client,
management-http,
backup-ndmp-control,
management-snmp-server,
management-ntp-server,
management-log-forwarding

If it is not there (allowed services), you can add it.

[ConfusedParrotfish]

Node- and Cluster-mgmt interfaces have the management-log-forwarding service configured. I can probably remove the service from the cluster_mgmt to prevent it from sending syslogs. 

[ConfusedParrotfish]

I just looked at all the other clusters and they all have the management-log-forwarding service configured on node and cluster mgmt. I'm still confused why only one cluster behaves like that.

[Sanaman]

So both node management and cluster management using the same "service-policy" across all the clusters. Also, your node management and cluster management on same network. No specific routes exists. Right?

[JMN227]

Have you figured this out? I have the same issue and haven't been able to find the answer.

[Sanaman]

Mine worked after removing the cluster interfaces from management-log-forwarding.