NetApp ONTAP Event Log: EMS Show and Filter Commands

When something goes wrong on a NetApp ONTAP cluster, the Event Management System (EMS) log is the first place to look - it records every significant event with a severity level, the node it happened on, and a message name. The challenge is volume: a busy cluster generates thousands of events, and most of them are informational. This guide shows how to use event log show with its filter parameters - event name, severity, message name, time range and node - so you can isolate the events that matter instead of paging through the whole log.

The event log show Command

Run without parameters, the command displays EMERGENCY, ALERT and ERROR events, most recent first:

cluster1::> event log show
Time                Node             Severity      Event
------------------- ---------------- ------------- ------------------------
11/9/2015 13:54:19  node1            NOTICE        vifmgr.portup: A link up event...

Use the -severity parameter to include less severe events, and -detail for the full message with remediation action fields.

Filtering by Event or Message Name

Event names follow the pattern component.event. Search with wildcards - the search is case-sensitive:

cluster1::> event log show -event *disk*
cluster1::> event log show -event *"Completed block"*
cluster1::> event log show -message-name *reboot*

The -message-name filter is especially useful for finding node reboots, failovers and scheduled maintenance events (for example vsa.scheduledEvent.scheduled on CVO systems).

Filtering by Severity

Severity levels run from EMERGENCY down through ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFORMATIONAL and DEBUG. To see everything at warning level or worse:

cluster1::> event log show -severity <=WARNING

To see only NOTICE-level messages that mention reboot:

cluster1::> event log show -severity NOTICE -message-name *reboot*

Filtering by Time

Time filters accept absolute values (MM/DD/YYYY HH:MM:SS), ranges and relative values based on "now":

cluster1::> event log show -time >=5m          <!-- last 5 minutes -->
cluster1::> event log show -time >=5h          <!-- last 5 hours -->
cluster1::> event log show -time <1h           <!-- more than one hour ago -->
cluster1::> event log show -time >=3/4/2026 16:25:00
cluster1::> event log show -time "3/4/2026 16:25:00".."3/4/2026 16:35:00"

Understanding What an Event Means

Each event has a catalog entry explaining why it was raised and what to do. Look up events with:

cluster1::> event catalog show -event-name <name>

The event's "action" field describes the remedy. Events are also shipped in AutoSupport reports, so Active IQ / NetApp Console history is a second source when local logs have rotated.

Forwarding EMS Events to Syslog

For real-time monitoring, forward EMS events to an external syslog server. ONTAP events follow the syslog standard:

cluster1::> event notification destination create -name SYSLOG1 -destination syslog://10.10.10.10:514
cluster1::> event notification create -name TO-SYSLOG -destination SYSLOG1 -severity warning

Inspect the current EMS configuration (log rotation, filters) with event config show and event filter show. With the diagnostic privilege set you can adjust EMS log rotation size when you need to retain more history locally.

Related reading: NetApp ONTAP CLI cheat sheet and NetApp ONTAP network troubleshooting CLI commands.

Original article: NetApp: event log show (ONTAP CLI reference) | NetApp KB: How to search the event (EMS) log in ONTAP