Skip to main content

Manage audit log destinations

Contributors netapp-barbe netapp-forry netapp-aaron-holt netapp-thomi netapp-aherbin
PDFs

You can forward the audit log to a maximum of 10 destinations. For example, you can forward the log to a Splunk or syslog server for monitoring, analysis, or backup purposes.

About this task

To configure forwarding, you must provide the IP address of the syslog or Splunk host, its port number, a transmission protocol, and the syslog facility to use for the forwarded logs. Learn about syslog facilities.

You can select one of the following transmission values using the -protocol parameter:

UDP Unencrypted

User Datagram Protocol with no security (default)

TCP Unencrypted

Transmission Control Protocol with no security

TCP Encrypted

Transmission Control Protocol with Transport Layer Security (TLS)
A Verify server option is available when the TCP Encrypted protocol is selected.

The default port is 514 for UDP and 6514 for TCP, but you can designate any port that meets the needs of your network.

You can select one of the following message formats using the -message-format command:

legacy-netapp

A variation of the RFC-3164 Syslog format (format: <PRIVAL>TIMESTAMP HOSTNAME: MSG)

rfc-5424

Syslog format as per RFC-5424 (format: <PRIVAL>VERSION TIMESTAMP HOSTNAME: MSG)

You can forward audit logs from the ONTAP CLI, and beginning with ONTAP 9.11.1, from System Manager.

System Manager

  • To display audit log destinations, select Cluster >Settings.
    A count of log destinations is shown in the Notification Management tile. Click Menu options icon to show details.

  • To add, modify, or delete audit log destinations, select Events & Jobs > Audit Logs, then click Manage Audit Destinations in the upper right of the screen.
    Click Add icon, or click Menu options icon in the Host Address column to edit or delete entries.