11-Network Management and Monitoring Configuration Guide

HomeSupportSwitchesS12500X-AF SeriesConfigure & DeployConfiguration GuidesH3C S12500X-AF Switch Series Configuration Guides(R3606)-6W10011-Network Management and Monitoring Configuration Guide
19-Information center configuration
Title Size Download
19-Information center configuration 216.14 KB

Contents

Configuring the information center 1

About the information center 1

Log types· 1

Log levels· 1

Log destinations· 2

Default output rules for standard system logs· 2

Default output rules for diagnostic logs· 2

Default output rules for security logs· 2

Default output rules for hidden logs· 3

Default output rules for trace logs· 3

Log formats and field descriptions· 3

Information center tasks at a glance· 6

Managing standard system logs· 6

Managing hidden logs· 6

Managing security logs· 7

Managing diagnostic logs· 7

Managing trace logs· 7

Enabling the information center 7

Outputting logs to various destinations· 8

Outputting logs to the console· 8

Outputting logs to the monitor terminal 8

Outputting logs to log hosts· 9

Outputting logs to the log buffer 10

Saving logs to the log file· 11

Enabling synchronous information output 12

Configuring log suppression· 12

Enabling duplicate log suppression· 12

Configuring log suppression for a module· 13

Disabling an interface from generating link up or link down logs· 13

Enabling SNMP notifications for system logs· 13

Managing security logs· 14

Saving security logs to the security log file· 14

Managing the security log file· 15

Saving diagnostic logs to the diagnostic log file· 15

Saving trace logs to the trace log file· 16

Display and maintenance commands for information center 16

Information center configuration examples· 17

Example: Outputting logs to the console· 17

Example: Outputting logs to a UNIX log host 17

Example: Outputting logs to a Linux log host 19

 


Configuring the information center

About the information center

The information center on the device receives logs generated by source modules and outputs logs to different destinations according to log output rules. Based on the logs, you can monitor device performance and troubleshoot network problems.

Figure 1 Information center diagram

 

Log types

Logs are classified into the following types:

·     Standard system logs—Record common system information. Unless otherwise specified, the term "logs" in this document refers to standard system logs.

·     Diagnostic logs—Record debug messages.

·     Security logs—Record security information, such as authentication and authorization information.

·     Hidden logs—Record log information not displayed on the terminal, such as input commands.

·     Trace logs—Record system tracing and debug messages, which can be viewed only after the devkit package is installed.

Log levels

Logs are classified into eight severity levels from 0 through 7 in descending order. The information center outputs logs with a severity level that is higher than or equal to the specified level. For example, if you specify a severity level of 6 (informational), logs that have a severity level from 0 to 6 are output.

Table 1 Log levels

Severity value

Level

Description

0

Emergency

The system is unusable. For example, the system authorization has expired.

1

Alert

Action must be taken immediately. For example, traffic on an interface exceeds the upper limit.

2

Critical

Critical condition. For example, the device temperature exceeds the upper limit, the power module fails, or the fan tray fails.

3

Error

Error condition. For example, the link state changes.

4

Warning

Warning condition. For example, an interface is disconnected, or the memory resources are used up.

5

Notification

Normal but significant condition. For example, a terminal logs in to the device, or the device reboots.

6

Informational

Informational message. For example, a command or a ping operation is executed.

7

Debugging

Debug message.

 

Log destinations

The system outputs logs to the following destinations: console, monitor terminal, log buffer, log host, and log file. Log output destinations are independent and you can configure them after enabling the information center. One log can be sent to multiple destinations.

Default output rules for standard system logs

A log output rule specifies the source modules and severity level of logs that can be output to a destination. Logs matching the output rule are output to the destination. Table 2 shows the default log output rules for standard system logs.

Table 2 Default output rules for standard system logs

Destination

Log source modules

Output switch

Severity

Console

All supported modules

Enabled

Debugging

Monitor terminal

All supported modules

Disabled

Debugging

Log host

All supported modules

Enabled

Informational

Log buffer

All supported modules

Enabled

Informational

Log file

All supported modules

Enabled

Informational

Default output rules for diagnostic logs

Diagnostic logs can only be output to the diagnostic log file, and cannot be filtered by source modules and severity levels. Table 3 shows the default output rule for diagnostic logs.

Table 3 Default output rule for diagnostic logs

Destination

Log source modules

Output switch

Severity

Diagnostic log file

All supported modules

Enabled

Debugging

 

Default output rules for security logs

Security logs can only be output to the security log file, and cannot be filtered by source modules and severity levels. Table 4 shows the default output rule for security logs.

Table 4 Default output rule for security logs

Destination

Log source modules

Output switch

Severity

Security log file

All supported modules

Disabled

Debugging

 

Default output rules for hidden logs

Hidden logs can be output to the log host, the log buffer, and the log file. Table 5 shows the default output rules for hidden logs.

Table 5 Default output rules for hidden logs

Destination

Log source modules

Output switch

Severity

Log host

All supported modules

Enabled

Informational

Log buffer

All supported modules

Enabled

Informational

Log file

All supported modules

Enabled

Informational

 

Default output rules for trace logs

Trace logs can only be output to the trace log file, and cannot be filtered by source modules or severity levels. Table 6 shows the default output rules for trace logs.

Table 6 Default output rules for trace logs

Destination

Log source modules

Output switch

Severity

Trace log file in the memory

All supported modules

Enabled

Debugging

Trace log file on the storage device

All supported modules

Enabled

Error

 

Log formats and field descriptions

Log formats

The format of logs varies by output destinations. Table 7 shows the original format of log information, which might be different from what you see. The actual format varies by the log resolution tool used.

Table 7 Log formats

Output destination

Format

Console, monitor terminal, log buffer, or log file

Prefix Timestamp Sysname Module/Level/Mnemonic: Content

Example:

%Nov 24 14:21:43:502 2016 Sysname SHELL/5/SHELL_LOGIN: VTY logged in from 192.168.1.26

Log host

Standard format:

<PRI>Timestamp Sysname %%vvModule/Level/Mnemonic: Location; Content

Example:

<190>Nov 24 16:22:21 2016 Sysname %%10SHELL/5/SHELL_LOGIN: -DevIP=1.1.1.1; VTY logged in from 192.168.1.26

Unicom format:

<PRI>Timestamp Hostip vvModule/Level/Serial_number: Content

Example:

<189>Oct 13 16:48:08 2016 10.1.1.1 10SHELL/5/210231a64jx073000020: VTY logged in from 192.168.1.21

CMCC format:

<PRI>Timestamp Sysname %vvModule/Level/Mnemonic: Location; Content

Example:

<189>Oct 9 14:59:04 2016 Sysname %10SHELL/5/SHELL_LOGIN: -DevIP=1.1.1.1; VTY logged in from 192.168.1.21

Log field description

Table 8 Log field description

Field

Description

Prefix (information type)

A log to a destination other than the log host has an identifier in front of the timestamp:

·     An identifier of percent sign (%) indicates a log with a level equal to or higher than informational.

·     An identifier of asterisk (*) indicates a debug log or a trace log.

·     An identifier of caret (^) indicates a diagnostic log.

PRI (priority)

A log destined to the log host has a priority identifier in front of the timestamp. The priority is calculated by using this formula: facility*8+level, where:

·     facility is the facility name. Facility names local0 through local7 correspond to values 16 through 23. The facility name can be configured using the info-center loghost command. It is used to identify log sources on the log host, and to query and filter the logs from specific log sources.

·     level is in the range of 0 to 7. See Table 1 for more information about severity levels.

Timestamp

Records the time when the log was generated.

Logs sent to the log host and those sent to the other destinations have different timestamp precisions, and their timestamp formats are configured with different commands. For more information, see Table 9 and Table 10.

Hostip

Source IP address of the log. If the info-center loghost source command is configured, this field displays the IP address of the specified source interface. Otherwise, this field displays the sysname.

This field exists only in logs that are sent to the log host in unicom format.

Serial number

Serial number of the device that generated the log.

This field exists only in logs that are sent to the log host in unicom format.

Sysname (host name or host IP address)

The sysname is the host name or IP address of the device that generated the log. You can use the sysname command to modify the name of the device.

%% (vendor ID)

Indicates that the information was generated by an H3C device.

This field exists only in logs sent to the log host.

vv (version information)

Identifies the version of the log, and has a value of 10.

This field exists only in logs that are sent to the log host.

Module

Specifies the name of the module that generated the log. You can enter the info-center source ? command in system view to view the module list.

Level

Identifies the level of the log. See Table 1 for more information about severity levels.

Mnemonic

Describes the content of the log. It contains a string of up to 32 characters.

Location

Optional field that identifies the log sender. This field exists only in logs that are sent to the log host in standard or cmcc format.

The field contains the following information:

·     Devlp—IP address of the log sender.

·     Slot—Slot number of the card that sent the log.

Content

Provides the content of the log.

Table 9 Timestamp precisions and configuration commands

Item

Destined to the log host

Destined to the console, monitor terminal, log buffer, and log file

Precision

Seconds

Milliseconds

Command used to set the timestamp format

info-center timestamp loghost

info-center timestamp

Table 10 Description of the timestamp parameters

Timestamp parameters

Description

boot

Time that has elapsed since system startup, in the format of xxx.yyy. xxx represents the higher 32 bits, and yyy represents the lower 32 bits, of milliseconds elapsed.

Logs that are sent to all destinations other than a log host support this parameter.

Example:

%0.109391473 Sysname FTPD/5/FTPD_LOGIN: User ftp (192.168.1.23) has logged in successfully.

0.109391473 is a timestamp in the boot format.

date

Current date and time, in the format of mmm dd hh:mm:ss yyy for logs that are output to a log host, or MMM DD hh:mm:ss:xxx YYYY for logs that are output to other destinations.

All logs support this parameter.

Example:

%May 30 05:36:29:579 2003 Sysname FTPD/5/FTPD_LOGIN: User ftp (192.168.1.23) has logged in successfully.

May 30 05:36:29:579 2003 is a timestamp in the date format.

iso

Timestamp format stipulated in ISO 8601.

Only logs that are sent to a log host support this parameter.

Example:

<189>2003-05-30T06:42:44 Sysname %%10FTPD/5/FTPD_LOGIN: User ftp (192.168.1.23) has logged in successfully.

2003-05-30T06:42:44 is a timestamp in the iso format.

none

No timestamp is included.

All logs support this parameter.

Example:

% Sysname FTPD/5/FTPD_LOGIN: User ftp (192.168.1.23) has logged in successfully.

No timestamp is included.

no-year-date

Current date and time without year information, in the format of MMM DD hh:mm:ss:xxx.

Only logs that are sent to a log host support this parameter.

Example:

<189>May 30 06:44:22 Sysname %%10FTPD/5/FTPD_LOGIN: User ftp (192.168.1.23) has logged in successfully.

May 30 06:44:22 is a timestamp in the no-year-date format.

Information center tasks at a glance

Managing standard system logs

1.     Enabling the information center

2.     Outputting logs to various destinations

Choose the following tasks as needed:

¡     Outputting logs to the console

¡     Outputting logs to the monitor terminal

¡     Outputting logs to log hosts

¡     Outputting logs to the log buffer

¡     

¡     Saving logs to the log file

3.     (Optional.) Enabling synchronous information output

4.     (Optional.) Configuring log suppression

Choose the following tasks as needed:

¡     Enabling duplicate log suppression

¡     Configuring log suppression for a module

¡     Disabling an interface from generating link up or link down logs

5.     (Optional.) Enabling SNMP notifications for system logs

Managing hidden logs

6.     Enabling the information center

7.     Outputting logs to various destinations

Choose the following tasks as needed:

¡     Outputting logs to log hosts

¡     Outputting logs to the log buffer

¡     

¡     Saving logs to the log file

8.     (Optional.) Configuring log suppression

Choose the following tasks as needed:

¡     Enabling duplicate log suppression

¡     Configuring log suppression for a module

Managing security logs

9.     Enabling the information center

10.     (Optional.) Configuring log suppression

Choose the following tasks as needed:

¡     Enabling duplicate log suppression

¡     Configuring log suppression for a module

11.     Managing security logs

¡     

¡     Saving security logs to the security log file

¡     Managing the security log file

Managing diagnostic logs

12.     Enabling the information center

13.     (Optional.) Configuring log suppression

Choose the following tasks as needed:

¡     Enabling duplicate log suppression

¡     Configuring log suppression for a module

14.     Saving diagnostic logs to the diagnostic log file

Managing trace logs

15.     Enabling the information center

16.     (Optional.) Configuring log suppression

Choose the following tasks as needed:

¡     Enabling duplicate log suppression

¡     Configuring log suppression for a module

17.     Saving trace logs to the trace log file

Enabling the information center

About this task

The information center can output logs only after it is enabled.

Procedure

1.     Enter system view.

system-view

2.     Enable the information center.

info-center enable

The information center is enabled by default.

Outputting logs to various destinations

Outputting logs to the console

Restrictions and guidelines

The terminal monitor, terminal debugging, and terminal logging commands take effect only for the current connection between the terminal and the device. If a new connection is established, the default is restored.

Procedure

1.     Enter system view.

system-view

2.     Configure an output rule for sending logs to the console.

info-center source { module-name | default } console { deny | level severity }

For information about default output rules, see "

Default output rules for standard system logs."

3.     (Optional.) Configure the timestamp format.

info-center timestamp { boot | date | none }

The default timestamp format is date.

4.     Return to user view.

quit

5.     Enable log output to the console.

terminal monitor

By default, log output to the console is enabled.

6.     Enable the display of debug information on the current terminal.

terminal debugging

By default, the display of debug information on the current terminal is disabled .

7.     Set the lowest severity level of logs that can be output to the console.

terminal logging level severity

The default setting is 6 (informational).

Outputting logs to the monitor terminal

About this task

Monitor terminals refer to terminals that log in to the device through the AUX or VTY line.

Restrictions and guidelines

The terminal monitor, terminal debugging, and terminal logging commands take effect only for the current connection between the terminal and the device. If a new connection is established, the default is restored.

Procedure

1.     Enter system view.

system-view

2.     Configure an output rule for sending logs to the monitor terminal.

info-center source { module-name | default } monitor { deny | level severity }

For information about default output rules, see "

Default output rules for standard system logs."

3.     (Optional.) Configure the timestamp format.

info-center timestamp { boot | date | none }

The default timestamp format is date.

4.     Return to user view.

quit

5.     Enable log output to the monitor terminal.

terminal monitor

By default, log output to the monitor terminal is disabled.

6.     Enable the display of debug information on the current terminal.

terminal debugging

By default, the display of debug information on the current terminal is disabled.

7.     Set the lowest level of logs that can be output to the monitor terminal.

terminal logging level severity

The default setting is 6 (informational).

Outputting logs to log hosts

Restrictions and guidelines

The device supports the following methods (in descending order of priority) for outputting logs of a module to designated log hosts:

·     Fast log output.

For information about the modules that support fast log output and how to configure fast log output, see "Configuring fast log output."

·     Flow log.

For information about the modules that support flow log output and how to configure flow log output, see "Configuring flow log."

·     Information center.

If you configure multiple log output methods for a module, only the method with the highest priority takes effect.

Procedure

1.     Enter system view.

system-view

2.     (Optional.) Configure a log output filter or a log output rule. Choose one option as needed:

¡     Configure a log output filter.

info-center filter filter-name { module-name | default } { deny | level severity }

You can create multiple log output filters. When specifying a log host, you can apply a log output filter to the log host to control log output.

¡     Configure a log output rule for the log host output destination.

info-center source { module-name | default } loghost { deny | level severity }

For information about the default log output rules for the log host output destination, see "

Default output rules for standard system logs."

The system chooses the settings to control log output to a log host in the following order:

a.     Log output filter applied to the log host.

b.     Log output rules configured for the log host output destination by using the info-center source command.

c.     Default log output rules (see "

d.     Default output rules for standard system logs").

3.     (Optional.) Specify a source IP address for output logs.

info-center loghost source interface-type interface-number

By default, the source IP address of output logs is the primary IP address of their outgoing interfaces.

4.     (Optional.) Specify the format in which logs are output to log hosts.

info-center format { unicom | cmcc }

By default, logs are output to log hosts in standard format.

5.     (Optional.) Configure the timestamp format.

info-center timestamp loghost { date | iso | no-year-date | none }

The default timestamp format is date.

6.     Specify a log host and configure related parameters.

info-center loghost [ vpn-instance vpn-instance-name ] { hostname | ipv4-address | ipv6 ipv6-address } [ port port-number ] [ facility local-number ] [ filter filter-name ]

By default, no log hosts or related parameters are specified.

The value for the port-number argument must be the same as the value configured on the log host. Otherwise, the log host cannot receive logs.

Outputting logs to the log buffer

Procedure

1.     Enter system view.

system-view

2.     Configure an output rule for sending logs to the log buffer.

info-center source { module-name | default } logbuffer { deny | level severity }

For information about default output rules, see "

Default output rules for standard system logs."

3.     (Optional.) Configure the timestamp format.

info-center timestamp { boot | date | none }

The default timestamp format is date.

4.     Enable log output to the log buffer.

info-center logbuffer

By default, log output to the log buffer is enabled.

5.     (Optional.) Set the maximum number of logs that can be stored in the log buffer.

info-center logbuffer size buffersize

By default, the log buffer can store a maximum of 512 logs.

Saving logs to the log file

About this task

By default, the log file feature saves logs from the log file buffer to the log file at the specified saving interval. You can also manually trigger an immediate saving of buffered logs to the log file. After saving logs to the log file, the system clears the log file buffer.

The device automatically creates log files as needed. Each log file has a maximum capacity.

The following example describes how the system handles the log files:

1.     The device automatically creates logfile1.log as needed.

2.     When logfile1.log is full, the system compresses logfile1.log as logfile1.log.gz and creates a new log file named logfile2.log. The process repeats until the last log file is full.

3.     After the last log file is full, the device locates the oldest compressed log file logfileX.log.gz and creates a new file using the same name (logfileX.log).

4.     When logfileX.log is full, the device compresses the log file as logfileX.log.gz to replace the existing file logfileX.log.gz.

As a best practice, back up the log files regularly to avoid loss of important logs.

Procedure

1.     Enter system view.

system-view

2.     Configure an output rule for sending logs to the log file.

info-center source { module-name | default } logfile { deny | level severity }

For information about default output rules, see "

Default output rules for standard system logs."

3.     Enable the log file feature.

info-center logfile enable

By default, the log file feature is enabled.

4.     (Optional.) Set the maximum log file size.

info-center logfile size-quota size

The maximum log file size is 20 MB.

5.     (Optional.) Specify the log file directory.

info-center logfile directory dir-name

The default log file directory is flash:/logfile.

6.     Save logs in the log file buffer to the log file. Choose one option as needed:

¡     Configure the automatic log file saving interval.

info-center logfile frequency freq-sec

The log file saving interval is 86400 seconds.

¡     Manually save logs in the log file buffer to the log file.

logfile save

This command is available in any view.

Enabling synchronous information output

About this task

System log output interrupts ongoing configuration operations, obscuring previously entered commands. Synchronous information output shows the obscured commands. It also provides a command prompt in command editing mode, or a [Y/N] string in interaction mode so you can continue your operation from where you were stopped.

Procedure

1.     Enter system view.

system-view

2.     Enable synchronous information output.

info-center synchronous

By default, synchronous information output is disabled.

Configuring log suppression

Enabling duplicate log suppression

About this task

Output of consecutive duplicate logs (logs that have the same module name, level, mnemonic, location, and text) wastes system and network resources.

With duplicate log suppression enabled, the device starts a suppression period upon outputting a log:

·     If only duplicate logs are received during the suppression period, the information center does not output the duplicate logs. When the suppression period expires, the information center outputs the suppressed log and the number of times the log is suppressed.

·     If a different log is received during the suppression period, the information center performs the following operations:

¡     Outputs the suppressed log and the number of times the log is suppressed.

¡     Outputs the different log and starts a suppression period for that log.

·     If no logs are received during the suppression period, the information center does not output any logs when the suppression period expires.

Procedure

1.     Enter system view.

system-view

2.     Enable duplicate log suppression.

info-center logging suppress duplicates

By default, duplicate log suppression is disabled.

Configuring log suppression for a module

About this task

This feature suppresses output of logs. You can use this feature to filter out the logs that you are not concerned with.

Perform this task to configure a rule to suppress output of all or specific logs from a module.

Procedure

1.     Enter system view.

system-view

2.     Configure a log suppression rule for a module.

info-center logging suppress module module-name mnemonic { all | mnemonic-value }

By default, the device does not suppress output of any logs from any modules.

Disabling an interface from generating link up or link down logs

About this task

By default, an interface generates link up or link down log information when the interface state changes. In some cases, you might want to disable certain interfaces from generating this information. For example:

·     You are concerned about the states of only some interfaces. In this case, you can use this function to disable other interfaces from generating link up and link down log information.

·     An interface is unstable and continuously outputs log information. In this case, you can disable the interface from generating link up and link down log information.

Use the default setting in normal cases to avoid affecting interface status monitoring.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Disable the interface from generating link up or link down logs.

undo enable log updown

By default, an interface generates link up and link down logs when the interface state changes.

Enabling SNMP notifications for system logs

About this task

This feature enables the device to send an SNMP notification for each log message it outputs. The device encapsulates the logs in SNMP notifications and then sends them to the SNMP module and the log trap buffer.

You can configure the SNMP module to send received SNMP notifications in SNMP traps or informs to remote hosts. For more information, see "Configuring SNMP."

To view the traps in the log trap buffer, access the MIB corresponding to the log trap buffer.

Procedure

1.     Enter system view.

system-view

2.     Enable SNMP notifications for system logs.

snmp-agent trap enable syslog

By default, the device does not send SNMP notifications for system logs.

3.     Set the maximum number of traps that can be stored in the log trap buffer.

info-center syslog trap buffersize buffersize

By default, the log trap buffer can store a maximum of 1024 traps.

Managing security logs

Saving security logs to the security log file

About this task

Security logs are very important for locating and troubleshooting network problems. Generally, security logs are output together with other logs. It is difficult to identify security logs among all logs.

To solve this problem, you can save security logs to the security log file without affecting the current log output rules.

After you enable the security log file feature, the device processes security logs as follows:

1.     Outputs security logs to the security log file buffer.

2.     Saves logs from the security log file buffer to the security log file at the specified interval.

If you have the security-audit role, you can also manually save security logs to the security log file.

3.     Clears the security log file buffer immediately after the security logs are saved to the security log file.

Restrictions and guidelines

The device supports only one security log file. The device will overwrite old logs with new logs when the security log file is full. To avoid security log loss, you can set an alarm threshold for the security log file usage ratio. When the alarm threshold is reached, the device outputs a message to inform you of the alarm. You can log in to the device with the security-audit user role and back up the security log file to prevent the loss of important data.

Procedure

1.     Enter system view.

system-view

2.     Enable the security log file feature.

info-center security-logfile enable

By default, the security log file feature is disabled.

3.     Set the interval at which the device saves security logs.

info-center security-logfile frequency freq-sec

By default, the security log file saving interval is 86400 seconds.

4.     (Optional.) Set the maximum size for the security log file.

info-center security-logfile size-quota size

By default, the maximum size for the security log file is 10 MB.

5.     (Optional.) Set the alarm threshold of the security log file usage.

info-center security-logfile alarm-threshold usage

By default, the alarm threshold of the security log file usage ratio is 80. When the usage of the security log file reaches 80%, the device will send a message.

Managing the security log file

Restrictions and guidelines

To use the security log file management commands, you must have the security-audit user role. For information about configuring the security-audit user role, see AAA in Security Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Change the directory of the security log file.

info-center security-logfile directory dir-name

By default, the security log file is saved in the seclog directory in the root directory of the storage device.

3.     Manually save all logs in the security log file buffer to the security log file.

security-logfile save

This command is available in any view.

4.     (Optional.) Display the summary of the security log file.

display security-logfile summary

This command is available in any view.

Saving diagnostic logs to the diagnostic log file

About this task

By default, the diagnostic log file feature saves diagnostic logs from the diagnostic log file buffer to the diagnostic log file at the specified saving interval. You can also manually trigger an immediate saving of diagnostic logs to the diagnostic log file. After saving diagnostic logs to the diagnostic log file, the device clears the diagnostic log file buffer.

The device supports only one diagnostic log file. The diagnostic log file has a maximum capacity. When the capacity is reached, the device replaces the oldest diagnostic logs with new logs.

Procedure

1.     Enter system view.

system-view

2.     Enable the diagnostic log file feature.

info-center diagnostic-logfile enable

By default, the diagnostic log file feature is enabled.

3.     (Optional.) Set the maximum diagnostic log file size.

info-center diagnostic-logfile quota size

The maximum size for the diagnostic log file is 10 MB.

4.     (Optional.) Specify the diagnostic log file directory.

info-center diagnostic-logfile directory dir-name

The default diagnostic log file directory is flash:/diagfile.

5.     Save diagnostic logs in the diagnostic log file buffer to the diagnostic log file. Choose one option as needed:

¡     Configure the automatic diagnostic log file saving interval.

info-center diagnostic-logfile frequency freq-sec

By default, the diagnostic log file saving interval is 86400 seconds.

¡     Manually save diagnostic logs to the diagnostic log file.

diagnostic-logfile save

This command is available in any view.

Saving trace logs to the trace log file

About this task

The device saves all trace logs in memory and you cannot view the trace logs stored in the memory.

This feature enables the device to save a copy of trace logs with severity levels 0 through 3 to the trace log file on the storage device. You can view the trace logs in the trace log file stored on the storage device.

The device saves trace logs from the trace log file buffer to the trace log file at the trace log file saving interval. You can also manually trigger an immediate saving of trace logs to the trace log file. After saving trace logs to the trace log file, the device clears the trace log file buffer.

The device supports only one trace log file on the storage device. The trace log file has a maximum capacity. When the capacity is reached, the device replaces the oldest trace logs with new logs.

Procedure

1.     Enter system view.

system-view

2.     (Optional.) Set the maximum trace log file size.

info-center trace-logfile quota size

By default, the maximum size for the trace log file is 1 MB.

Display and maintenance commands for information center

Execute display commands in any view and reset commands in user view.

 

Task

Command

Display the diagnostic log file configuration.

display diagnostic-logfile summary

Display the information center configuration.

display info-center

Display information about log output filters.

display info-center filter [ filter-name ]

Display log buffer information and buffered logs.

display logbuffer [ reverse ] [ level severity | size buffersize | slot slot-number ] *

Display the log buffer summary.

display logbuffer summary [ level severity | slot slot-number ] *

Display the log file configuration.

display logfile summary

Display summary information of the security log file. (To execute this command, you must have the security-audit user role.)

display security-logfile summary

Clear the log buffer.

reset logbuffer

Information center configuration examples

Example: Outputting logs to the console

Network configuration

Configure the device to output to the console FTP logs that have a minimum severity level of warning.

Figure 2 Network diagram

 

Procedure

# Enable the information center.

<Device> system-view

[Device] info-center enable

# Disable log output to the console.

[Device] info-center source default console deny

To avoid output of unnecessary information, disable all modules from outputting log information to the specified destination (console in this example) before you configure the output rule.

# Configure an output rule to output to the console FTP logs that have a minimum severity level of warning.

[Device] info-center source ftp console level warning

[Device] quit

# Enable the display of logs on the console. (This function is enabled by default.)

<Device> terminal logging level 6

<Device> terminal monitor

The current terminal is enabled to display logs.

Now, if the FTP module generates logs, the information center automatically sends the logs to the console, and the console displays the logs.

Example: Outputting logs to a UNIX log host

Network configuration

Configure the device to output to the UNIX log host FTP logs that have a minimum severity level of informational.

Figure 3 Network diagram

 

Procedure

Before the configuration, make sure the device and the log host can reach each other. (Details not shown.)

1.     Configure the device:

# Enable the information center.

<Device> system-view

[Device] info-center enable

# Specify log host 1.2.0.1/16 with local4 as the logging facility.

[Device] info-center loghost 1.2.0.1 facility local4

# Disable log output to the log host.

[Device] info-center source default loghost deny

To avoid output of unnecessary information, disable all modules from outputting logs to the specified destination (loghost in this example) before you configure an output rule.

# Configure an output rule to output to the log host FTP logs that have a minimum severity level of informational.

[Device] info-center source ftp loghost level informational

2.     Configure the log host:

The log host configuration procedure varies by the vendor of the UNIX operating system. The following shows an example:

a.     Log in to the log host as a root user.

b.     Create a subdirectory named Device in directory /var/log/, and then create file info.log in the Device directory to save logs from Device.

# mkdir /var/log/Device

# touch /var/log/Device/info.log

c.     Edit file syslog.conf in directory /etc/ and add the following contents.

# Device configuration messages

local4.info /var/log/Device/info.log

In this configuration, local4 is the name of the logging facility that the log host uses to receive logs. The value of info indicates the informational severity level. The UNIX system records the log information that has a minimum severity level of informational to file /var/log/Device/info.log.

 

 

NOTE:

Follow these guidelines while editing file /etc/syslog.conf:

·     Comments must be on a separate line and must begin with a pound sign (#).

·     No redundant spaces are allowed after the file name.

·     The logging facility name and the severity level specified in the /etc/syslog.conf file must be identical to those configured on the device by using the info-center loghost and info-center source commands. Otherwise, the log information might not be output to the log host correctly.

 

d.     Display the process ID of syslogd, kill the syslogd process, and then restart syslogd by using the –r option to validate the configuration.

# ps -ae | grep syslogd

147

# kill -HUP 147

# syslogd -r &

Now, the device can output FTP logs to the log host, which stores the logs to the specified file.

Example: Outputting logs to a Linux log host

Network configuration

Configure the device to output to the Linux log host 1.2.0.1/16 FTP logs that have a minimum severity level of informational.

Figure 4 Network diagram

 

Procedure

Before the configuration, make sure the device and the log host can reach each other. (Details not shown.)

1.     Configure the device:

# Enable the information center.

<Device> system-view

[Device] info-center enable

# Specify log host 1.2.0.1/16 with local5 as the logging facility.

[Device] info-center loghost 1.2.0.1 facility local5

# Disable log output to the log host.

[Device] info-center source default loghost deny

To avoid outputting unnecessary information, disable all modules from outputting log information to the specified destination (loghost in this example) before you configure an output rule.

# Configure an output rule to enable output to the log host FTP logs that have a minimum severity level of informational.

[Device] info-center source ftp loghost level informational

2.     Configure the log host:

The log host configuration procedure varies by the vendor of the Linux operating system. The following shows an example:

a.     Log in to the log host as a root user.

b.     Create a subdirectory named Device in directory /var/log/, and create file info.log in the Device directory to save logs of Device.

# mkdir /var/log/Device

# touch /var/log/Device/info.log

c.     Edit file syslog.conf in directory /etc/ and add the following contents.

# Device configuration messages

local5.info /var/log/Device/info.log

In this configuration, local5 is the name of the logging facility that the log host uses to receive logs. The value of info indicates the informational severity level. The Linux system will store the log information with a severity level equal to or higher than informational to file /var/log/Device/info.log.

 

 

NOTE:

Follow these guidelines while editing file /etc/syslog.conf:

·     Comments must be on a separate line and must begin with a pound sign (#).

·     No redundant spaces are allowed after the file name.

·     The logging facility name and the severity level specified in the /etc/syslog.conf file must be identical to those configured on the device by using the info-center loghost and info-center source commands. Otherwise, the log information might not be output to the log host correctly.

 

d.     Display the process ID of syslogd, kill the syslogd process, and then restart syslogd by using the -r option to validate the configuration.

Make sure the syslogd process is started with the -r option on a Linux log host.

# ps -ae | grep syslogd

147

# kill -9 147

# syslogd -r &

Now, the device can output FTP logs to the log host, which stores the logs to the specified file.

 

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网