The primary advantage of forwarding audit logs to a remote syslog server is to centralize log data from multiple sources into a secure, consolidated repository. This enables long-term retention and allows Security Information and Event Management (SIEM) systems to perform correlation and advanced security analytics. Centralization helps in detecting security threats, investigating incidents, and meeting compliance requirements by providing a unified view of activities across the enterprise. It also protects logs from being tampered with on the source system.

A. Forwarding logs introduces network latency and a minor processing overhead; it does not reduce latency within ONTAP.

C. AutoSupport collects diagnostic data independently and does not require remote syslog forwarding to function.

D. The process of forwarding logs adds a slight load to the system and network, so it does not increase cluster performance.

1. NetApp ONTAP 9 Documentation, "Log management and auditing overview." It states, "Forwarding audit records to a syslog server enables you to centralize records from all SVMs in the cluster and from other network devices."

2. NetApp ONTAP 9 Security Hardening Guide (TR-4569), Section 5.1 "Auditing and Logging." This section emphasizes the importance of sending logs to a central, secure log host for analysis and to prevent tampering.