Login
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 05-Data analysis center configuration | 78.20 KB |
Contents
Configuring the data analysis center
About the data analysis center
Data analysis center tasks at a glance
Enabling real-time log display
Enabling real-time traffic statistics collection
Configuring report subscription
Configuring report subscription parameters
Configuring data storage limits for a service
Display and maintenance commands for data analysis center
Configuring the data analysis center
About the data analysis center
The data analysis center collects and analyzes log data for services and provides the analysis results in various forms of reports through the Web interface. This feature allows you to learn about the service traffic statistics and the network security status, helping you make decisions when customizing service policies.
Log data storage and analysis
The data analysis center collects log data from various service modules for central analysis and reporting. The log data are preferably stored in a hard disk. If no hard disk is available, the data are stored in the memory.
Reporting
In addition to the traffic monitoring reports, you can also configure the data analysis center to generate the following types of reports and send them to designated subscribers:
· Summary report—Displays summarized service traffic statistics collected over a time range.
· Comparison report—Provides comparison of service traffic statistics collected over two time ranges that contain the same number of days.
· Intelligent report—Provides intelligent analysis of users' work efficiency, data leakage, and turnover risks based on their network access behaviors.
· Integrated report—Illustrates the overall device operational and network security status based on analysis of critical service statistics.
Data analysis center tasks at a glance
To configure the data analysis center, perform the following tasks:
· Enabling real-time log display
· Enabling real-time traffic statistics collection
· Configuring report subscription
¡ Configuring report subscription parameters
· Configuring data storage limits for a service
Enabling log collection
About this task
The log collection feature enables the data analysis center to collect the log messages of specific services and extracts the data for summarization and analysis. You can see the relevant data analysis information in the dashboard and monitor pages of the Web interface.
Restrictions and guidelines
To collect the log messages for the traffic service, first enable the session statistics collection and then enable the log collection. For more information about the session statistics collection, see session management in Security Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Enable the log collection for a service.
dac log-collect service service-type service-name enable
By default, the log collection status for each service varies by service setting when the service module is registered to the DAC.
Enabling real-time log display
About this task
With this feature enabled for a service, the data analysis center will send the service log messages to the Web interface in real time. You can see the real-time logs on the Web interface without refreshing the log lists manually.
Restrictions and guidelines
The real-time log display setting for a service takes effect only after the log collection for the service is enabled by the dac log-collect enable command.
Procedure
1. Enter system view.
system-view
2. Enable the real-time log display.
dac log-display service service-type service-name enable
The log collection status for each service varies by service setting when the service module is registered to the DAC.
Enabling real-time traffic statistics collection
About this task
The data analysis center can collect the user and application traffic statistics in real time and send the statistics result to the Web interface.
Restrictions and guidelines
To collect the traffic statistics in real time, you must first enable the session statistics collection. For more information about the session statistics collection, see session management in Security Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Enable real-time traffic statistics collection.
dac traffic-statistics { application | user } enable [ verbose ]
By default, the real-time collection of traffic statistics is disabled.
Configuring report subscription
About report subscription
After you add a subscriber for a report, the report will be sent to the subscriber through email.
For the subscribers to receive the report, you must configure the email server.
By default, the daily report is sent during the least busy hours (1 a.m. to 5 a.m.). The monthly report of the previous month is sent on the first day of each month. The report sending time cannot be changed.
Configure the email server
1. Enter system view.
system-view
2. Specify the email server address.
dac email-server server-address address-string
By default, no email server is specified for the data analysis center.
3. Specify the email sender address.
dac email-server sender address-string
By default, the email sender address is not specified.
4. (Optional.) Specify the DNS server address.
dac email-server dns-server ip-address
By default, no DNS server address is specified.
5. (Optional.) Configure email client authentication.
a. Enable email client authentication.
dac email-server client-authentication enable
By default, email client authentication is disabled.
b. Specify the username for email client authentication.
dac email-server username username
By default, no username is specified for email client authentication.
c. Specify the password for email client authentication.
dac email-server password { cipher | simple } string
By default, no password is specified for email client authentication.
d. Enable secure transmission of client authentication credentials.
dac email-server secure-authentication enable
By default, secure transmission of client authentication credentials is disabled.
Configuring report subscription parameters
1. Enter system view.
system-view
2. Configure the subscription parameters for a report type.
dac report type { comparison | integrated | intelligent | summary } subscriber mail-address [ language { chinese | english } ]
By default, no report subscription parameters are configured.
Configuring data storage limits for a service
About this task
Perform this task to set the storage time limit, storage space usage limit, and the storage limit-violated action for a service.
The data analysis center periodically checks the data of each service to determine if the storage time or storage space usage limit is exceed.
· If a storage limit is exceeded and the action is delete, the system deletes the expired or the oldest service data. A log will be generated to report the event.
· If a storage limit is exceeded and the action is log-only, the system generates a log message. New data will not be saved.
Procedure
1. Enter system view.
system-view
2. Set the storage time limit, storage space usage limit, or the storage limit-triggered action for a service.
dac storage service service-type service-name limit { hold-time time-value | usage usage-value | action { delete | log-only } }
By default:
¡ The service data can be saved for a maximum of 365 days.
¡ The data of each service can occupy up to 20% of the total storage space.
¡ If the storage time or storage space usage limit is exceeded, the system deletes the expired or the oldest data.
Display and maintenance commands for data analysis center
Execute the display commands in any view.
|
Task |
Command |
|
Display the email server configuration. |
display dac email-server |
|
Display the log collection configuration for a service. |
display dac log-collect { all | service service-type service-name } |
|
Display the configuration of the real-time log display. |
display dac log-display { all | service service-type service-name } |
|
Display the report subscription information. |
display dac report [ comparison | integrated | intelligent | summary ] |
|
Display the service storage limit settings. |
display dac storage [ service-type service-name ] |
|
Display the configuration of the real-time traffic statistics collection. |
display dac traffic-statistics [ application | user ] |
