H3C Technologies H3C SecPath F1000-E - Manual (Page 928)

6
Item Description
Log Host 2
log host. The log host can analyze and display the flow logs to remotely monitor the
device.
You can specify up to two different userlog log hosts.
IMPORTANT:
To avoid collision with the common UDP port numbers, you are recommended to
use a UDP port number in the range from 1025 to 65535.
Output flows logs to
information center
Set to output flow logs to the information center in the format of system information.
IMPORTANT:
z With this function enabled, flow logs will not be output to the specified userlog
log host.
z Outputting flow logs to the information center occupies the storage space of
the device. Therefore, you are recommended to output flow logs to the
information center in case that there are a small amount of flow logs.
Displaying flow logging statistics
If you set to send flow logs in UDP packets to the specified userlog log host, you can view the related
statistics, including the total number of flow logs sent to the log host, the total number of UDP packets and
the total number of flow logs stored on the device cache.
If you click the Statistics expansion button on the Flow Log page, you can view the information as
shown in
Figure 3 .
You can clear all the flow logging statistics of the device and the flow logs in the cache by clicking
Reset.
Figure 3 View flow logging statistics
Session Logging
Session Logging Overview
Session logging records users’ access information, IP address translation information, and traffic
information, and can output the records in a specific format to a log host, allowing administrators to
perform security auditing.
Session logging records an entry for a session if it reaches the specified threshold. Session logging
supports two categories of thresholds: