Configuring fast log output

0

Emergency

The system is unusable. For example, the system authorization has expired.

1

Alert

Action must be taken immediately. For example, traffic on an interface exceeds the upper limit.

2

Critical

Critical condition. For example, the device temperature exceeds the upper limit, the power module fails, or the fan tray fails.

3

Error

Error condition. For example, the link state changes.

4

Warning

Warning condition. For example, an interface is disconnected, or the memory resources are used up.

5

Notification

Normal but significant condition. For example, a terminal logs in to the device, or the device reboots.

6

Informational

Informational message. For example, a command or a ping operation is executed.

7

Debugging

Debug message.

NAT session log

CMCC format:

<PRI> Version Timestamp HostName AppName ProcID MsgID Start Time|End Time|Original Source IP|OriginalSource Port|TranslatedSource IP|Translated Source Port|Destination IP|Destination Port|Protocol

Example:

<142> 1 2020 Apr 28 15:35:32 100.0.0.1 H3C - NAT444:SessionA 1588088133|0|100.0.0.18|1111|139.0.0.223|10000|114.0.0.15|2222|17

Telecom format:

<PRI> Version Timestamp HostName AppName ProcID MsgID [Protocol Original Source IP VpnName Original Source IPv6 Translated Source IP VpnName Original Source Port Translated Source Port -]

Example:

<134> 1 2020 Apr 28 15:35:38 100.0.0.1 H3C - NAT444:sessionbasedA [17 100.0.0.18 vpn1 - 139.0.0.223 vpn1 1111 11000 -]

Unicom format:

<PRI>Version Timestamp HostName AppName ProcID MsgID Start Time|End Time|Original Source IP |Translated Source IP|Translated Source Port|Destination IP|Destination Port|Protocol

Example:

<142> 1 2020 Apr 28 15:35:43 100.0.0.1 H3C - NAT444:SessionA 1588088144|0|100.0.0.18|139.0.0.223|12000|114.0.0.15|2222|17

eLog format:

<PRI> Version Timestamp HostName AppName - MsgType [L4 PrivateIP – PublicIP PrivatePort PublicPort -]

Example:

<134>1 2020 Jan 17 11:05:55 10.1.1.1 test - NAT444:SessionbasedA [17 10.1.1.2 - 172.16.1.1 0 1025 -]

NAT444 user log

CMCC format:

<PRI> Version Timestamp HostName AppName ProcID MsgID Start Time|Original Source IP|Translated Source IP|Translated First Source Port|Translated Last Source Port

Example:

<142> 1 2020 Apr 28 15:35:32 100.0.0.1 H3C - NAT444:PortA 1588088133|100.0.0.18|139.0.0.223|10000|10999

Telecom format:

<PRI> Version Timestamp HostName AppName ProcID MsgID [Protocol Original Source IP VpnName Original Source IPv6 Translated Source IP VpnName Original Source Port Translated First Source Port Translated Last Source Port]

Example:

<134> 1 2020 Apr 28 15:35:38 100.0.0.1 H3C - NAT444:userbasedA [17 100.0.0.18 vpn1 - 139.0.0.223 vpn1 - 11000 11999]

Unicom format:

<PRI> Version Timestamp HostName AppName ProcID MsgID Start Time|Original Source IP|Translated Source IP |Translated First Source Port|Translated Last Source Port

Example:

<142> 1 2020 Apr 28 15:35:43 100.0.0.1 H3C - NAT444:PortA 1588088144|100.0.0.18|139.0.0.223|12000|12999

eLog format:

<PRI>Version Timestamp1 HostName - - NAT444userbased - %%SyslogVerMODULENAME/LOGLEVEL/LOGINFOMNEM(LOGTYPE): UserORINCType, in Scenario scene. privateip='PrivateIP' srcvrfid='VRFID' publicip='PublicIP' publicportrange='StartPort~EndPort' time='Timestamp2'

Example:

<134>1 2020-01-17T10:24:40Z 10.1.1.1 - - NAT444userbased - %%01SEC/6/BIND(L): An initial portrange is assigned, in nat444 scene. privateip='10.1.1.2' srcvrfid='0' publicip='172.16.1.1' publicportrange='2048~3071' time='2020-01-17 10:24:40'

DS-Lite user log

eLog format:

<PRI>Version Timestamp1 HostName - - DS-LITEuserbased - %%SyslogVerMODULENAME/LOGLEVEL/LOGINFOMNEM(LOGTYPE): UserORINCType, in Scenario scene. privateip='PrivateIP/LEN' srcvrfid='VRFID' publicip='PublicIP' publicportrange='StartPort~EndPort' time='Timestamp2'

Example:

<134>1 2020-01-17T16:23:22Z 10.1.1.1 - - DS-LITEuserbased - %%01SEC/6/BIND(L): An initial portrange is assigned, in dslite scene. privateip='2001:DB8:2::2/128' srcvrfid='0' publicip='10.38.160.107' publicportrange='1024~2047' time='2020-01-17 16:23:22'

AFT user log

eLog format:

<PRI>Version Timestamp1 HostName - - NAT64userbased - %%SyslogVerMODULENAME/LOGLEVEL/LOGINFOMNEM(LOGTYPE): UserORINCType, in Scenario scene. privateip='PrivateIP/LEN' srcvrfid='VRFID' publicip='PublicIP' publicportrange='StartPort~EndPort' time='Timestamp2'

Example:

<134>1 2020-01-17T16:55:17Z 10.1.1.1 - - NAT64userbased - %%01SEC/6/BIND(L): An initial portrange is assigned, in nat64 scene. privateip='2001:DB8:1::2:2/128' srcvrfid='0' publicip='10.11.11.100' publicportrange='1024~2047' time='2020-01-17 16:55:17'

NAT alarm log

CMCC format:

<PRI> Version Timestamp HostName AppName ProcID MsgID Start Time|Original Source IP|Translated Source IP

Example:

<142> 1 2020 Apr 28 15:35:32 100.0.0.1 H3C - NAT444:PortF 1588088133|100.0.0.18|139.0.0.223

Telecom format:

<PRI> Version Timestamp HostName AppName ProcID MsgID [Protocol Original Source IP VpnName Original Source IPv6 Translated Source IP VpnName - - -]

Example:

<134> 1 2020 Apr 28 15:35:38 100.0.0.1  H3C - NAT444:userbasedF [17 100.0.0.18 vpn1 - 139.0.0.223 vpn1 - - -]

Unicom format:

<PRI> Version Timestamp HostName AppName ProcID MsgID StartTime|OriginalSourceIP|TranslatedSourceIP

Example:

<142> 1 2020 Apr 28 15:35:43 100.0.0.1 H3C - NAT444:PortF 1588088144|100.0.0.18|139.0.0.223

Header

PRI

Priority identifier. The priority is calculated by using this formula: facility*8+level, where:

·     facility is the facility name used to identify the log source at the log host. The facility name is fixed to 17, 16, and 17 for CMCC, Telecom, and Unicom, respectively.

·     level is in the range of 0 to 7. See Table 1 for more information about severity levels.

Version

Version of the log. This field is fixed to 1.

Timestamp

Time when the log was generated, accurate to seconds. The timestamp format is <year><mon> <day> <hh:mm:ss>, where:

·     year represents the year.

·     mon represents the month.

·     day represents the date.

·     hh:mm:ss represents the exact time.

You can execute the customlog timestamp localtime command to configure the timestamp of fast output logs to show the system time. By default, the timestamp shows the Greenwich Mean Time (GMT).

HostName

Source IP address of the log. If the customlog host source command is configured, this field displays the IP address of the specified source interface. Otherwise, this field displays a hyphen (-).

AppName

Name of the device that generated the log. You can use the sysname command to modify the name of the device.

ProcID

Reserved field.

This field displays a hyphen (-).

MsgID

Log message type in the format of <device type>:<message type>.

The device type is NAT444, DSLITE, and NAT64 for NAT444, and NAT64 networks, respectively.

Available message types include:

·     UserbasedA—Specifies user-based port assignment log.

·     UserbasedW—Specifies user-based port withdrawal log.

·     SessionbasedA—Specifies session-based port assignment log.

·     SessionbasedW—Specifies session-based port withdrawal log.

·     PortA—Specifies port range assignment log.

·     PortF—Specifies port range resource insufficient log.

·     PortW—Specifies port range withdrawal log.

·     SessionA—Specifies session start log.

·     SessionW—Specifies session end log.

·     SessionU—Specifies session log with a session URL.

MSG content

Protocol

Transmission layer protocol. Options include:

·     6—TCP.

·     17—UDP.

·     1—ICMP.

Start Time

NAT session start time, seconds elapsed since 1970-1-1 00:00:00.

End Time

NAT session end time, seconds elapsed since 1970-1-1 00:00:00. This field is 0 in a session start log message.

Original Source IP

Source IPv4 address before NAT. This field is displayed as 0.0.0.0 in a user-based port assignment log message when users come online through a VPN connection.

VpnName

VPN instance name of the source IPv4 address. In the current software version, only China Telecom format supports displaying VPN information, and China CMCC format or China Unicom format does not.

Original Source IPv6

Source IPv6 address before NAT.

Original Source Port

Source port number before NAT.

Translated Source IP

Source IPv4 address after NAT.

Translated First Source port

First source port number after NAT.

Translated Last Source port

Last source port number after NAT.

Destination IP

Destination IP address.

Destination Port

Destination port number.

Header

PRI

Priority identifier. This field is fixed to 134.

Version

Version of the log. This field is fixed to 1.

Timestamp1

Time when the log was generated, in the format of YEAR-MONTH-DAYTHOUR:MINUTE:SECONDZ (GMT).

HostName

Source IP address of the log, which is the IP address of the egress interface that sends the log. If the customlog host source command is executed, this field displays the IP address of the specified source interface.

AppName

Name of the device that generated the log. You can use the sysname command to modify the name of the device.

SyslogVer

Syslog version. This field is fixed to 1.

MODULENAME

Module name. This field is fixed to SEC.

LOGLEVEL

Log level. This field is fixed to 6.

LOGINFOMNEM

Mnemonic. This field is fixed to BIND.

LOGTYPE

Log type. This field is fixed to L.

UserORINCType

User log type, including:

·     An initial portrange is assigned—User-based port assignment log.

·     An initial portrange is freed—User-based port withdrawal log.

·     An increase portrange is assigned—User-based extended port assignment log.

·     An increase portrange is freed—User-based extended port withdrawal log

Scenario

Transition technology scenario, including:

·     NAT444

·     DS-Lite

·     NAT64

MsgType

Field type, including the following parts:

·     Device type—NAT444, DS-Lite, and NAT64.

·     Message type—SessionbasedA and SessionbasedW.

When a flow table is created, the message type is SessionbasedA. When a flow table ages out, the message type is SessionbasedW.

Timestamp2

Time when the log was generated, in the format of YEAR-MONTH-DAY HOUR:MINUTE:SECOND. By default, this timestamp shows the UTC time. If the customlog timestamp localtime command, this field displays the local time.

MSG content

PrivateIP

Private IP address of the user.

LEN

Prefix length of the private IPv6 address.

VRFID

VRF index.

PublicIP

Public IP address of the user after NAT.

StartPort

Start port of the user port block.

EndPort

End port of the user port block.

PrivatePort

Private port number of the user.

PublicPort

Public port number of the user after NAT.