What is the difference between "cluster log-forwarding" and "EMS notification"?
Applies to
- ONTAP 9
- Cloud Volumes ONTAP (CVO)
Answer
Cluster Log-Forwarding:
- Purpose: Offloads ONTAP events to a remote syslog server for secure storage and audit purposes.
- Configuration: Uses the cluster
log-forwarding create
command to set up destinations for remote logging. - Parameters: Includes destination host, port, protocol (e.g., udp-unencrypted, tcp-unencrypted, tcp-encrypted), server identity verification, syslog facility, and message format among others.
- Security: Ensures the integrity of event auditing by securely offloading logs to limit the scope of a breach.
EMS Notification:
- Purpose: Sends notifications of events defined by an event filter to one or more destinations (e.g., email, syslog, SNMP traphost).
- Configuration: Uses the
event notification create
command to set up notifications based on event filters. - Example:
event notification create -filter-name filter1 -destinations email_dest,syslog_dest,snmp-traphost
Each of these features provides different methods for handling and forwarding event data generated by the ONTAP system.