Accenture MDR Quick Start Guide for NetApp ONTAP

This quick start guide will help Accenture MDR customers configure NetApp ONTAP to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring NetApp ONTAP

There are two configurations need to be done for log forwarding:

1. Configuration for Audit logs.

2. Configuration for EMS logs.

Configuration for Audit logs:

To configure forwarding, you must provide the IP address of the syslog host, its port number, a transmission protocol, and the syslog facility to use for the forwarded logs.

Note: You can select one of the following transmission values:

UDP Unencrypted (default), TCP Unencrypted, TCP Encrypted

Configuration Steps:

1. Login to the cluster via ONTAP command line with admin privilege level.

2. For each destination that you want to forward the audit log to, specify the destination IP address or host name and any security options.

3. cluster1::> cluster log-forwarding create -destination 192.168.123.96 -port 514 -facility user.

4. Verify that the destination records are correct by using the cluster log-forwarding show command.

Open

Configuration for EMS logs:

To log notifications of the most severe events on a syslog server, you must configure the EMS to forward notifications for events that signal important activity.

You can perform this task any time the cluster is running by entering the commands on the ONTAP command line.

Note: DNS must be configured on the cluster to resolve the syslog server name.

Configuration Steps:

1. Login to the cluster via ONTAP command line with admin privilege level.

2. Create a syslog server destination:

event notification destination create -name <Name of the destination> -syslog <LCP Address>

3. Create an event filter named filter1 or any name you want:

event filter create -filter-name <Filter name>

Open

4. Configure all events to forward notifications to the syslog server:

event notification -filter-name <Name of the filter you created> -destinations <Name of the syslog destination created>

Note: EMS has some system defined filters. Like: “default-trap-events, “important-events“ and “no-info-debug-events“

• default-trap-events - This filter matches all ALERT and EMERGENCY events. It also matches all Standard, Built-in SNMP trap type events.

• important-events - This filter matches all ALERT and EMERGENCY events.

• no-info-debug-events - This filter matches all non-INFO and non-DEBUG messages (EMERGENCY, ALERT, ERROR and NOTICE).

The system-defined event filters cannot be modified or deleted.

LCP Configuration Parameters

Table 1-2: The NetApp ONTAP event collector (Syslog -3980) properties to be configured by Accenture are given in the table.