H3C Technologies H3C Intelligent Management Center - Manual (Page 34)

25
4. Run the log file audit tool.
5. In the Basic Settings area, perform the following tasks:
a. Click File Path. On the dialog box that appears, select the directory where the exported log
files are located.
b. In the Max Displayed Entries For Audit field, enter a value in the range of 1 to 100000, and
click Set.
6. In the Basic Conditions area, perform the following tasks:
a. Click Start Time and End Time to set the query time.
b. Select one or more query conditions and specify the corresponding values. Options are
Source, Destination, Source Port, Destination Port, Protocol, Application, and Device. Select
Meet All if you want to audit log files meeting all query conditions you have selected. Select
Meet Any if you want to audit log files meeting any of the query conditions you have selected.
7. In the Special Conditions area, perform the following tasks:
a. Select the Special Conditions option.
b. Select one special condition and configure parameters for the special condition.
8. Click Query.
The Audit Result page appears and displays all matching log files.
9. Click Save to save the audit results.
Managing applications
The application management function allows you to manage the following types of applications:
• Layer 4 applications—Applications that are indentified by the combination of the protocol and the
port. For example, the combination of TCP and port 80 identifies HTTP applications. UBA
predefines more than 200 common Layer 4 applications. You can also create Layer 4 applications
by specifying the protocol and the port if necessary.
• Layer 7 applications—Applications that use dynamic ports and are indentified by the
characteristics of Layer 7 data, such as BT, and eDonkey, and other P2P applications. Applications
that use dynamic ports are common in most networks. These applications consume considerable
UBA system resources. UBA predefines most of the applications that use dynamic ports as Layer 7
applications, such as BTDC, eDonkey, and MSN. You can also create Layer 7 applications by
specifying the regular expression strings that UBA uses to compare against the contents of the
Layer 7 portion of IP packet if necessary. Layer 7 application identification is applicable to only
flow records that are collected from probes.
Viewing the application list
1. Access the Settings page.
2. Click the Application Management link or icon .
The Application Management page appears and displays all predefined applications and custom
applications.
Application List contents
{
Application—Name of the application. You can click the application name to view application
details.