After configuring modules for a Remote Syslog Server, the settings are as shown. The administrator notices that even though the level parameter is set to EMERGENCY, that all monitor logs are being…

Question

Options

• AA second rsyslog server is configured to send all monitor logs.
• BHaving the Module Name set to STARGATE sends all monitor logs regardless of the level.
• CA Log Level of EMERGENCY includes all monitor logs.
• DThe true setting for Include Monitor Logs sends all monitor logs regardless of the level.

• A
  12% (4)
• B
  6% (2)
• C
  79% (26)
• D
  3% (1)

Explanation

In syslog severity, EMERGENCY is the highest-severity level (level 0), but in Nutanix's Remote Syslog configuration, setting the level to EMERGENCY means the system sends logs at EMERGENCY severity and all lower-severity (less critical) levels beneath it - which includes ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, and DEBUG. In other words, EMERGENCY acts as a 'catch-all' threshold that includes every log message because no level is more severe. This is a common point of confusion: administrators expect EMERGENCY to filter only the most critical messages, but the level setting defines the floor of what is captured, not a specific severity filter. The 'Include Monitor Logs' true flag (Option D) does forward monitor logs, but the root cause of ALL logs being sent is the EMERGENCY level behavior.

No community discussion yet for this question.