Summary: How to setup syslog on a Netapp Filer.
Date: Around 2015
Refactor: 7 March 2025: Checked links and formatting.

Configuring syslog on a netapp filer is pretty straight forward, with one catch. You can't edit the /etc/syslog.conf file, and that for two reasons:

1. There is no syslog.conf
2. There is no editor

You can create an empty syslog.conf file however, and while doing that, put in all the required configuration. So first step is looking at the current sample file so you can create the syslog.conf from that:

filer1> rdfile /etc/syslog.conf.sample
# $Id: //depot/prod/ontap/R7.3.4x/files/syslog.conf.sample#1 $
# Copyright (c) 1994-1996 Network Appliance.
# All rights reserved.
# Sample syslog.conf file.  Copy to /etc/syslog.conf to use.
# You must use TABS for separators between fields.

# Log messages of priority info or higher to the console and to /etc/messages
*.info                                  /dev/console
*.info                                  /etc/messages

# Edit and uncomment following line to log all messages of priority
# err or higher and all kernel messages to a remote host, e.g. adminhost
# *.err;kern.*                          @adminhost

# Edit and uncomment following line to log all messages of priority
# err or higher and all kernel messages to the local7 facility of the
# syslogd on a remote host, e.g. adminhost.
# *.err;kern.*                          local7.*@adminhost

# Edit and uncomment following line to log all messages of priority
# err or higher and all kernel messages to a remote host, e.g. adminhost,
# at priority debug.
# *.err;kern.*                          *.debug@adminhost

# Edit and uncomment following line to log all messages of priority
# err or higher and all kernel messages to the local5 facility of the
# syslogd on a remote host, e.g. adminhost, at priority info.
# *.err;kern.*                          local5.info@adminhost

Now that we have the original file we'll recreate the file:

filer1> wrfile /etc/syslog.conf

Notice that the file is empty.

Fill in all the original information and an extra line for your syslog server:

# $Id: //depot/prod/ontap/R7.3.4x/files/syslog.conf.sample#1 $
# Copyright (c) 1994-1996 Network Appliance.
# All rights reserved.
# Sample syslog.conf file.  Copy to /etc/syslog.conf to use.
# You must use TABS for separators between fields.

# Log messages of priority info or higher to the console and to /etc/messages
*.info                                  /dev/console
*.info                                  /etc/messages
*.info                                  @10.10.5.14

# Edit and uncomment following line to log all messages of priority
# err or higher and all kernel messages to a remote host, e.g. adminhost
# *.err;kern.*                          @adminhost

# Edit and uncomment following line to log all messages of priority
# err or higher and all kernel messages to the local7 facility of the
# syslogd on a remote host, e.g. adminhost.
# *.err;kern.*                          local7.*@adminhost

# Edit and uncomment following line to log all messages of priority
# err or higher and all kernel messages to a remote host, e.g. adminhost,
# at priority debug.
# *.err;kern.*                          *.debug@adminhost

# Edit and uncomment following line to log all messages of priority
# err or higher and all kernel messages to the local5 facility of the
# syslogd on a remote host, e.g. adminhost, at priority info.
# *.err;kern.*                          local5.info@adminhost

Make sure you leave an empty line at the end. Press <CTRL>+C to close the editor. Check the file when you're done with the rdfile command.

You should, btw, see a line like this when you're done:

filer1> Thu May  5 14:31:28 CEST [filer1: kern.syslogd.restarted:info]: syslogd: Restarted.

This is the file I always use which I find the most convenient to work with:

# Set the alert level for the console
*.err                                   /dev/console
# Set the alert level for the local messages file
*.info                                  /etc/messages
# Set the alert level for the syslog server
*.info                                  @10.10.5.14