Prism Central allows you to configure syslog monitoring which forwards system logs(API Audit, Audit and Flow logs) from the registered clusters to an external syslog server

There are some consideration we need to be aware of:

1. As the logs are forwarded form Controller VM(CVM). It displays IP address of CVM

2. We can only configure one rsyslog server 

3. Protocols which are supported are TCP and UDP

4. Logs can also be forwarded to a remote syslog server using Reliable Event Logging Protocol (RELP).

Configuration of the syslog server is very simple. 

1. Login to Prim Central and go to settings

2.click syslog server

3. Add the external syslog server name, IP address and port

4. All the registered clusters will now forward logs to syslog server

For more details on syslog please refer following documents

https://portal.nutanix.com/page/documents/details/?targetId=Prism-Central-Guide-Prism-v5_16%3Amul-syslog-server-configure-pc-t.html

https://portal.nutanix.com/page/documents/details/?targetId=Advanced-Admin-AOS-v511%3Aset-rsyslog-config-c.html