The event log show command displays entries from ems.log. ONTAP Event Management System messages record significant occurrences in the cluster, such as hardware events, protocol issues, availability messages, and errors that support engineers use for diagnosis. messages.log is a broader system log concept, but event log show queries the event log/EMS content. bcomd.log and mgwd.log are daemon-specific logs and are not the direct source for event log show output. Knowing which command maps to which log matters because support investigations often require collecting the right file rather than searching every diagnostic bundle blindly. If the engineer needs administrative command activity, audit.log is used; if the engineer needs cluster events, EMS/event log is used. The correct mapping for this question is event log show to ems.log. References
/topics: ONTAP EMS, event log show, ems.log, cluster event troubleshooting, and log-source selection.
Reference: https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-cmpr-930%
2Feventlogshow.html

Aggregate relocation enables nondisruptive hardware maintenance during an ONTAP upgrade or controller maintenance activity. ARL moves aggregate ownership between HA partners so that storage resources remain available while a node is serviced or upgraded. FlexVol and FlexGroup are volume types and do not provide the controller-level maintenance mechanism required in the scenario. RAID-TEC protects against multiple disk failures, but it does not move aggregates away from a controller for nondisruptive maintenance. The key support concept is that ONTAP nondisruptive operations rely on HA takeover/giveback and aggregate relocation to keep data online while hardware or software work occurs. For an upgrade from an older release to a later release, ARL is central when the process requires controller reboot or hardware service without forcing client downtime. This is why ARL is repeatedly tested in support exams: it is the operational bridge between hardware service and continuous data availability. References/topics: ONTAP nondisruptive upgrade, aggregate relocation, HA pair maintenance, controller availability, and upgrade readiness.
Reference: https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-hacg%2FGUID-
519510F4-AE00-4859-9706-217553D05FB9.html

ONTAP NVRAM stores uncommitted writes and is protected by battery or nonvolatile backup mechanisms, depending on platform generation. It is not a read cache; read caching is handled by buffer cache and, on some platforms, flash-based caching technologies. It is also not correctly described as a user-visible write cache in the simple sense, because WAFL uses NVRAM/NVLog as a protected log for writes that have been acknowledged to clients but not yet committed to disk through a consistency point. This distinction is important in support scenarios: NVRAM protects write consistency, enables fast acknowledgement, and supports recovery after interruption. The battery-backed/nonvolatile characteristic is critical because acknowledged writes must survive power loss or controller failure. A support engineer should connect NVRAM symptoms to write latency, HA mirroring, consistency point behavior, and recovery guarantees.
References/topics: ONTAP NVRAM/NVLog, consistency points, write protection, HA mirroring, and nonvolatile write logging.
Reference: https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/FAQ%
3A_Consistency_Point