ONTAP System Manager and Performance Archive are the appropriate data sources for explaining a wafl.cp.toolong event. A long consistency point indicates that WAFL took longer than expected to complete a CP, so the engineer needs both system event context and historical performance evidence. System Manager provides an operational view of cluster health, aggregate state, and performance indicators. Performance Archive provides the deeper time-series performance data needed to correlate the event with workload, disk, CPU, NVRAM, or aggregate behavior around the timestamp. Active IQ Unified Manager may be useful in broader monitoring, but the question asks for the data sources used to explain this specific EMS message. mgwd.log is a management daemon log and is not the primary source for WAFL CP performance analysis. The support approach is to correlate the EMS event with performance archive counters and visible system health. References/topics: wafl.cp.toolong EMS events, WAFL consistency points, Performance Archive, System Manager performance review, and ONTAP CP troubleshooting.