ARP event forwarding to syslog

[fiery hornet]

Does anyone have experience with forwarding ARP events to an external Syslog server? Which event filter can I use to forward only ARP events? Currently, I would use the following filter: ``` mycluster::> event filter show -filter-name arp
Filter Name Rule Rule Message Name SNMP Trap Type Severity
Position Type

---

arp
1 include arw.volume.state * *
2 include callhome.arw.activity.seen
* *
3 exclude * * *
3 entries were displayed.

mycluster::> ```

[scarlet oasis]

Check here: https://docs.netapp.com/us-en/ontap-ems-9131/arw-analytics-events.html

arw.analytics.high.entropy, arw.analytics.probability and arw.analytics.suspects might also be relevant.