Contents

Configuring the data analysis center 1

About the data analysis center 1

Log data storage and analysis· 1

Traffic monitoring· 1

Reporting· 1

Restrictions and guidelines: Data analysis center configuration· 1

Data analysis center tasks at a glance· 1

Enabling log collection· 2

Enabling real-time log display· 2

Enabling real-time traffic statistics collection· 3

Configuring the email server 3

Configuring report subscription· 4

Configuring report export 4

About report export 4

Restrictions and guidelines· 4

Prerequisites· 5

Configuring a report export template· 5

Configuring an LB link statistics report 5

Configuring an LB virtual server statistics report 5

Configuring report export parameters· 6

Configuring data storage limits for a service· 6

Display and maintenance commands for data analysis center 7

 

Configuring the data analysis center

About the data analysis center

The data analysis center collects and analyzes log data for services and provides the analysis results in various forms of reports through the Web interface. It supports log data storage, traffic monitoring, and report analysis. This feature allows you to learn about the service traffic statistics and the network security status, helping you make decisions when customizing service policies.

Log data storage and analysis

The data analysis center collects log data from various service modules for central analysis and reporting. You can store the log data in a hard disk, a USB drive, or the memory according to the storage priority in descending order. If the storage media of a higher priority is not available or its space is full, the data are stored in the storage media of a lower priority.

Traffic monitoring

The data analysis center generates real-time traffic trend and statistics reports from various perspectives, such as user, application, and IP address. These reports help you monitor the network traffic, locate network vulnerabilities, and secure the network against potential attacks.

Reporting

The data analysis center can generate the multiple types of reports for you to understand the information such as service statistics, device running status, and network security status.

Restrictions and guidelines: Data analysis center configuration

You can configure the data analysis center at the CLI. The reports generated by the data analysis center are available only in the Web interface.

Data analysis center tasks at a glance

To configure the data analysis center, perform the following tasks:

·     Enabling log collection

·     Enabling real-time log display

·     Enabling real-time traffic statistics collection

·     Configuring the email server

·     Configuring report subscription

·     Configuring report export

a.     Configuring a report export template

b.     Configuring the report contents

Choose one of the following tasks:

-     Configuring an LB link statistics report

-     Configuring an LB virtual server statistics report

c.     Configuring report export parameters

·     Configuring data storage limits for a service

Enabling log collection

About this task

The log collection feature enables the data analysis center to collect the log messages of specific services and extracts the data for summarization and analysis. You can see the relevant data analysis information in the dashboard and monitor pages of the Web interface.

Restrictions and guidelines

To collect the log messages for the traffic service, first enable the session statistics collection and then enable the log collection. For more information about the session statistics collection, see session management in Security Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Enable the log collection for a service.

dac log-collect service service-type service-name enable

By default, the log collection status for each service varies by service setting when the service module is registered to the DAC.

Enabling real-time log display

About this task

With this feature enabled for a service, the data analysis center will send the service log messages to the Web interface in real time. You can see the real-time logs on the Web interface without refreshing the log lists manually.

Restrictions and guidelines

The real-time log display setting for a service takes effect only after the log collection for the service is enabled by the dac log-collect enable command.

Procedure

1.     Enter system view.

system-view

2.     Enable the real-time log display.

dac log-display service service-type service-name enable

The log collection status for each service varies by service setting when the service module is registered to the DAC.

Enabling real-time traffic statistics collection

About this task

The data analysis center can collect the user and application traffic statistics in real time and send the statistics result to the Web interface.

Restrictions and guidelines

Enable real-time traffic statistics collection with caution when large-volume service traffic exists. This feature is CPU intensive.

To collect the traffic statistics in real time, you must first enable the session statistics collection. For more information about the session statistics collection, see session management in Security Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Enable real-time traffic statistics collection.

dac traffic-statistic { application | user } enable [ verbose ]

By default, the real-time collection of traffic statistics is disabled.

Configuring the email server

About this task

The report subscription and report export features require an email server to function correctly. The email server will send the reports to the subscribers or export the reports to the specified mail box.

Procedure

1.     Enter system view.

system-view

2.     Specify the email server address.

dac email-server server-address address-string

By default, no email server is specified for the data analysis center.

3.     Specify the email sender address.

dac email-server sender address-string

By default, the email sender address is not specified.

4.     (Optional.) Configure email client authentication.

a.     Enable email client authentication.

dac email-server client-authentication enable

By default, email client authentication is disabled.

b.     Specify the username for email client authentication.

dac email-server username username

By default, no username is specified for email client authentication.

c.     Specify the password for email client authentication.

dac email-server password { cipher | simple } string

By default, no password is specified for email client authentication.

d.     Enable secure transmission of client authentication credentials.

dac email-server secure-authentication enable

By default, secure transmission of client authentication credentials is disabled.

Configuring report subscription

About this task

The report subscription allows the device to generate and send periodic reports to the subscriber mail box.

By default, the daily report is sent during the least busy hours (1 am. to 5 am.) and the monthly report of the previous month is sent on the first day of each month. The report sending time cannot be changed.

The following types of reports are supported:

·     Summary report—Displays summarized service traffic statistics collected over a time range.

·     Comparison report—Provides comparison of service traffic statistics collected over two time ranges that contain the same number of days.

·     Intelligent report—Provides intelligent analysis of users' work efficiency, data leakage, and turnover risks based on their network access behaviors.

·     Integrated report—Illustrates the overall device operational and network security status based on analysis of critical service statistics.

Prerequisites

For the subscribers to receive the reports, you must configure the email server.

Procedure

1.     Enter system view.

system-view

2.     Configure the subscription parameters for a report type.

dac report type { comparison | integrated | intelligent | summary } subscriber mail-address [ language { chinese | english } ]

By default, no report subscription parameters are configured.

Configuring report export

About report export

Report export periodically or immediately exports statistics reports for specified services. The following types of export methods are available:

·     Automatic export—Exports periodic reports to the report destinations as scheduled. The report contents are defined in the report template.

·     Manual export—Exports reports immediately after you define the statistics contents and time range of the data.

Restrictions and guidelines

Manual report export is supported only on the Web interface of the product.

Report export is available only for LB services. For more information about LB, see load balancing in Load Balancing Configuration Guide.

Prerequisites

For the subscribers to receive the reports, you must configure the email server.

Configuring a report export template 

About this task

In a report export template, you can define the following items:

·     Report language.

·     Statistics contents in the report.

Procedure

1.     Enter system view.

system-view

2.     Create a report export template and enter its view.

dac report export template template-name

3.     (Optional.) Specify the language used in exported reports.

language { chinese | english }

By default, Chinese is used.

Configuring an LB link statistics report

1.     Enter system view.

system-view

2.     Enter the view of an existing report export template.

dac report export template template-name

3.     Create the LB link statistics report view and enter the veiw.

export-service lb-link

4.     Specify an LB link for the LB link statistics report.

statistics link name

By default, no LB link is specified for the LB link statistics report.

5.     Specify the contents for the LB link statistics report.

statistics content { abnormal-flow | app | connection-count | connection-rate | delay | packet-loss | stability }*

By default, no content is specified for the LB link statistics report.

Configuring an LB virtual server statistics report

1.     Enter system view.

system-view

2.     Enter the view of an existing report export template.

dac report export template template-name

3.     Create the LB virtual server statistics report view and enter the view.

export-service lb-virtual-server

4.     Specify an LB virtual server for the LB virtual server statistics report.

statistics virtual-server name

By default, no LB virtual server is specified for the LB virtual server statistics report.

5.     Specify the content for the LB virtual server statistics report.

statistics content class

By default, no content is specified for the LB virtual server statistics report.

Configuring report export parameters

About this task

You can define the type of the periodic report, report template, and the destination to which the reports are exported.

Procedure

1.     Enter system view.

system-view

2.     Configure report export parameters.

dac report export period { day | hour | month | quarter | week | year } template template-name [ mail-address mail-address ]

By default, no report export parameters are configured.

Configuring data storage limits for a service

About this task

Perform this task to set the storage time limit, storage space usage limit, and the storage limit-violated action for a service.

The data analysis center periodically checks the data of each service to determine if the storage time or storage space usage limit is exceed.

·     If a storage limit is exceeded and the action is delete, the system deletes the expired or the oldest service data. A log will be generated to report the event.

·     If a storage limit is exceeded and the action is log-only, the system generates a log message. New data will not be saved.

Procedure

1.     Enter system view.

system-view

2.     Set the storage time limit, storage space usage limit, or the storage limit-triggered action for a service.

dac storage service service-type service-name limit { hold-time time-value | usage usage-value | action { delete | log-only } }

By default:

¡     The service data can be saved for a maximum of 365 days.

¡     The data of each service can occupy up to 20% of the total storage space.

¡     If the storage time or storage space usage limit is exceeded, the system deletes the expired or the oldest data.

Display and maintenance commands for data analysis center

Execute the display commands in any view.

 

Task	Command
Display the email server configuration.	display dac email-server
Display the log collection configuration for a service.	display dac log-collect { all | service service-type service-name }
Display the configuration of the real-time log display.	display dac log-display { all | service service-type service-name }
Display the report subscription information.	display dac report [ comparison | integrated | intelligent | summary ]
Display report export configuration.	display dac report export
Display report export templates.	display dac report export template
Display the service storage limit settings.	display dac storage [ service-type service-name ]
Display the configuration of the real-time traffic statistics collection.	display dac traffic-statistic [ application | user ]

‌