### Human: Can you tell about NCC Health Check: ahv_remote_log_forwarding_check. ### Assistant: NCC 4.1.0 ahv_remote_log_forwarding_check detects issues with AHV host log forwarding to the configured remote server.. The NCC health check ahv_remote_log_forwarding_check detects whether log forwarding to remote server is operating normally.This check runs on only AHV, but also only if the cluster has had additional STIG DoDIN APL enablement performed on supported AOS/AHV versions. By default, and unless specific steps have been taken to enable this functionality on-demand, this check will return a PASS result.When remote log forwarding is needed to forward the AHV host logs to a remote machine, the host itself records the failure or success of sending these records to the remote machine (configured by the user by following the Portal Guide; Acropolis Advanced Administration Guide \ Configuring the Remote Syslog Server Settings). This status is maintained in an rsyslog stats file (/var/log/rsyslog-stats) on each AHV host. The records of success/failure is updated regularly and this health check parses the recent entries in that file to recognise any failures and trigger any alert workflows configured on the cluster such as email, syslog, SNMP trap, Prism Alert notifications.It can be run as part of the complete NCC check by running:
nutanix@cvm$ ncc health_checks run_all
 or individually as:

nutanix@cvm$ ncc health_checks run_all
 You can also run the checks from the Prism web console Health page: select Actions > Run Checks. Select All checks and click Run.This check runs on each CVM to assess its AHV host. It does not run on Prism Central.This check is scheduled to run every 5 minutes and produces a WARN alert after 3 consecutive failures.Sample Output:Check Status: PASS

nutanix@cvm$ ncc health_checks run_all
Check Status: WARN

nutanix@cvm$ ncc health_checks run_all

Output messaging

Check ID111088DescriptionCheck log forwarding to remote server.Causes of failureForwarding logs to remote server is failing.ResolutionsCheck failure causes for forwarding the logs to remote server. Refer KB10811.ImpactRemote server will not be receiving log output from cluster.Alert IDA111088Alert TitleForwarding logs to remote server is failing.Alert MessageForwarding logs to remote server is failing on host {host_ip}.
 . A warning produced by this check could indicate one or more of the following possible conditions:
Network connectivity issue between the AHV host and the remote rsyslog serverAHV host uplink or local network issueWAN/VPN/inter-site routing issue between Nutanix AHV cluster and remote rsyslog serverFirewall/ACL blocking AHV host communication to the remote rsyslog serverRemote rsyslog server offline/powered off, services failed, storage fullRemote rsyslog server unable to handle incoming volume of messages from one or more AHV hosts, or other rsyslog clients in addition to the AHV hosts.
From the affected AHV host(s), consider using the following commands/utils to help isolate the issue;

Ping the configured remote rsyslog server to expose any basic switching/routing issues.Use NCAT to test a protocol:port specific connection is able to be opened (or blocked by firewall/ACL) 

[root@AHV ~]# nc -zvu -w3 <remote_syslog_server_IP_FQDN> <remote_port_usually_514>

Investigate the contents of the /var/log/rsyslog-stats log file for any entries around the timestamp reported by this NCC check/alert.

[root@AHV ~]# nc -zvu -w3 <remote_syslog_server_IP_FQDN> <remote_port_usually_514>
In case the above mentioned steps do not resolve the issue, consider engaging Nutanix Support at https://portal.nutanix.com/To speed up the resolution time and minimize possible impact, collect and attach the following information to the support case:

A complete NCC report:

[root@AHV ~]# nc -zvu -w3 <remote_syslog_server_IP_FQDN> <remote_port_usually_514>

A log bundle generated from the cluster. This can be collected through Prism Web Console's health page. Select Actions > Collect Logs. Logs can also be collected through command line using logbay (KB 6691 - NCC - Logbay Quickstart Guide):

[root@AHV ~]# nc -zvu -w3 <remote_syslog_server_IP_FQDN> <remote_port_usually_514>

A copy of the /var/log/rsyslog-stats log file from any affected AHV host.. ### Human: Now explain this as a Nutanix support agent summarizing the answer step by step. In case, you don't know the answer say - I don't know.